Container Platform

Docker Overview

Docker is a platform for building, packaging, running, and shipping applications as containers. A container includes the application code, runtime, libraries, tools, and dependencies needed to run the service in a predictable way.

Docker helps developers and operations teams run the same application across laptops, test servers, staging, and production environments. It reduces the classic problem where software works in one environment but fails in another.

Runtime Model

Docker Architecture

Docker uses a client-server architecture. The Docker client sends commands to the Docker daemon. The daemon builds images, starts containers, manages networks, handles volumes, and communicates with registries.

Containers share the host operating system kernel, but they run in isolated namespaces. This makes them lighter than virtual machines, because each container does not need its own full operating system.

• Docker client: command line interface used by the user.
• Docker daemon: background service managing Docker objects.
• Images: layered templates used to create containers.
• Containers: isolated running processes.
• Registries: remote locations for storing images.

Build Layer

Docker Images

A Docker image is a read-only package. It contains the application, dependencies, runtime, configuration defaults, and file system layers. Images are built from a Dockerfile.

Images should be small, repeatable, and secure. In production, images should be pinned to clear versions instead of using unstable tags such as latest.

FROM nginx:1.27-alpine
COPY ./site /usr/share/nginx/html
EXPOSE 80
CMD ["nginx", "-g", "daemon off;"]

Good images are simple to rebuild. They do not contain secrets, temporary files, private keys, or unnecessary debugging tools.

Execution Layer

Docker Containers

A container is a running instance of an image. It runs as an isolated process on the host. Containers can be started, stopped, restarted, inspected, and removed.

docker run -d --name web -p 8080:80 nginx:1.27-alpine
docker ps
docker logs web
docker exec -it web sh
docker stop web
docker rm web

Containers should be treated as replaceable. Do not manually change important state inside a running container. Rebuild the image and redeploy the container instead.

Persistent Data

Docker Volumes

Containers are temporary by design. If a container is deleted, data written inside the container can be lost. Volumes solve this by storing data outside the container lifecycle.

docker volume create app-data
docker run -d --name database -v app-data:/var/lib/mysql mysql:8

Use volumes for databases, uploads, application state, and other persistent data. For production, backups and restore tests are required. A volume without backup is not a safe storage strategy.

Connectivity

Docker Networking

Docker networking allows containers to communicate with each other and with external systems. The default bridge network works for simple local use, but custom networks are cleaner and easier to control.

docker network create app-net
docker run -d --name api --network app-net my-api:1.0
docker run -d --name db --network app-net postgres:16

Containers on the same custom network can usually reach each other by container name. Published ports expose services from the container to the host.

Multi Container Apps

Docker Compose

Docker Compose defines multi-container applications in a YAML file. It is useful for local development, demos, test environments, and small internal stacks.

services:
  web:
    image: nginx:1.27-alpine
    ports:
      - "8080:80"
  redis:
    image: redis:7-alpine

docker compose up -d
docker compose ps
docker compose logs -f
docker compose down

Compose makes dependencies visible. It also gives developers a repeatable way to start the same stack.

Distribution

Docker Registry

A registry stores Docker images. Docker Hub is public, while many companies use private registries such as Harbor, GitHub Container Registry, GitLab Registry, Azure Container Registry, or AWS ECR.

docker login registry.example.com
docker tag app:1.0 registry.example.com/team/app:1.0
docker push registry.example.com/team/app:1.0
docker pull registry.example.com/team/app:1.0

Production images should use clear version tags. Avoid overwriting the same tag with different content unless your deployment process is designed for that.

Hardening

Docker Security

Docker security starts with small images, trusted base images, controlled permissions, and no secrets inside image layers. Containers should run with the least privilege possible.

• Do not run containers as root unless required.
• Scan images for known vulnerabilities.
• Use read-only file systems where possible.
• Do not mount the Docker socket into random containers.
• Keep host OS, Docker engine, and base images updated.
• Store secrets in a secret manager, not in Dockerfiles.

docker run --read-only --cap-drop ALL --security-opt no-new-privileges app:1.0

Operations

Production Architecture

Docker alone can run containers, but production needs more than container startup. A production platform needs logging, monitoring, image scanning, secrets, backups, health checks, restart policy, resource limits, and controlled deployment.

For larger systems, containers are often managed by Kubernetes, OpenShift, Nomad, or another orchestrator. These platforms add scheduling, scaling, self-healing, rolling updates, and service discovery.

Cheat Sheet

Useful Docker Commands

docker version
docker info
docker images
docker ps -a
docker build -t app:1.0 .
docker run -d --name app -p 8080:80 app:1.0
docker logs -f app
docker exec -it app sh
docker inspect app
docker stats
docker stop app
docker rm app
docker rmi app:1.0
docker system df
docker system prune

Be careful with prune commands. They can remove unused containers, networks, images, and build cache. Always check what is safe to remove first.

Summary

Key Takeaways

Docker packages applications into portable containers. Images define what should run. Containers are the running processes. Volumes keep data outside the container lifecycle. Networks connect services. Registries distribute images.

For production, Docker must be combined with security, monitoring, logging, backups, secrets management, resource limits, and deployment control. Containers are powerful, but they are not a full production platform by themselves.