Docker Introduction

Docker is a platform for building, shipping, and running applications inside containers. A container packages your application together with its runtime, libraries, and configuration, so it behaves the same on a laptop, a CI server, and production. This removes the classic "it works on my machine" problem and is the foundation for most modern DevOps and cloud-native workflows.

What Is a Container?

A container is an isolated process (or group of processes) running on the host operating system's kernel. The kernel gives each container its own view of the filesystem, process tree, network interfaces, and resource limits. A container is not a small virtual machine: it has no guest operating system and no hypervisor.

Docker makes this practical by providing:

• A standard image format for packaging an application and its dependencies.
• A runtime that starts images as isolated containers.
• A CLI and API to build, run, inspect, and distribute them.
• Registries (such as Docker Hub) to share images.

Containers vs Virtual Machines

Aspect	Virtual Machine	Container
Isolation level	Hardware (hypervisor)	Process (kernel namespaces and cgroups)
Operating system	Full guest OS per VM	Shares the host kernel
Typical size	Gigabytes	Megabytes to a few hundred megabytes
Startup time	Tens of seconds to minutes	Usually under a second
Resource overhead	High (each VM boots an OS)	Low
Isolation strength	Stronger (separate kernel)	Weaker (shared kernel)
Best for	Running different operating systems, strong tenant isolation	Packaging and scaling applications

Containers and VMs are often combined: containers run inside VMs on most cloud platforms.

Why Teams Use Docker

• Consistency: the same image runs in development, test, and production.
• Fast onboarding: a new developer runs one command instead of installing a database, a JDK, and a message broker by hand.
• Isolation: two apps needing different Java or Node versions can run side by side.
• Efficient scaling: containers start quickly and use fewer resources than VMs.
• Immutable deployments: you ship a versioned image and roll back by running the previous one.

Installing and Running Your First Container

Install Docker Engine (Linux) or Docker Desktop (macOS, Windows), then verify the installation:

docker --version
# Docker version 27.x.x, build ...

docker run hello-world
# Hello from Docker!
# This message shows that your installation appears to be working correctly.

docker run hello-world pulls the hello-world image from Docker Hub if it is not present locally, creates a container, runs it, and prints a message before exiting.

A More Realistic Example

Run an Nginx web server in the background and publish it on port 8080:

docker run -d --name web -p 8080:80 nginx:1.27

curl -I http://localhost:8080
# HTTP/1.1 200 OK
# Server: nginx/1.27.x

docker ps
# CONTAINER ID   IMAGE        COMMAND                  STATUS         PORTS                  NAMES
# 3f2a9c1b7d4e   nginx:1.27   "/docker-entrypoint...."  Up 5 seconds   0.0.0.0:8080->80/tcp   web

docker logs web
docker stop web
docker rm web

The flags used here:

• -d runs the container in the background (detached).
• --name web gives the container a readable name.
• -p 8080:80 maps host port 8080 to container port 80.

Core Terms

Term	Meaning
Image	A read-only template (layers plus metadata) used to create containers
Container	A running (or stopped) instance of an image
Dockerfile	A text file with instructions to build an image
Registry	A server that stores and distributes images, such as Docker Hub
Volume	Docker-managed storage that outlives a container
Network	A virtual network that lets containers talk to each other

What Makes Containers Possible

Docker relies on Linux kernel features. Namespaces isolate what a process can see (processes, network, mounts, hostnames, users). Control groups (cgroups) limit what it can use (CPU, memory, I/O). On macOS and Windows, Docker Desktop runs a lightweight Linux VM so these features are available. The next lesson covers this in more detail.

Common Mistakes

• Treating containers like VMs. Installing SSH, running several services in one container, and patching it in place goes against the model. Run one main process per container and rebuild the image to change it.
• Using the latest tag. nginx:latest can change under you, which makes builds and deployments unreproducible. Pin a specific version.
• Storing data inside the container. The container's writable layer is deleted with the container. Use volumes for databases and uploads.
• Assuming containers are fully secure sandboxes. They share the host kernel. Run as a non-root user and apply least privilege.
• Forgetting to clean up. Stopped containers, unused images, and old volumes accumulate and fill the disk.

Best Practices

• Pin image versions (for example postgres:16) rather than relying on latest.
• Keep one concern per container and keep containers disposable.
• Store persistent data in volumes and configuration in environment variables.
• Use official or verified images as base images, and keep them updated.
• Keep your Dockerfiles and Compose files in version control next to the code.

Interview Questions

1. What is Docker and what problem does it solve?

Docker is a platform to package an application and its dependencies into an image and run it as an isolated container. It solves environment inconsistency: the same image behaves identically across development, CI, and production. It also simplifies dependency management and speeds up deployments.

2. What is the difference between a container and a virtual machine?

A VM virtualizes hardware and runs a complete guest OS with its own kernel on top of a hypervisor. A container shares the host kernel and isolates only a process using namespaces and cgroups. Containers are lighter and start faster, while VMs provide stronger isolation.

3. Does a container have its own operating system?

A container has its own filesystem (the image contents, such as a Debian or Alpine userland), but it does not have its own kernel. It uses the host's kernel. This is why a Linux container cannot run natively on a Windows kernel without a Linux VM underneath.

4. What is the difference between an image and a container?

An image is a read-only, layered template. A container is a running instance of an image with an additional thin writable layer. You can start many containers from one image.

5. What Linux features does Docker rely on?

Namespaces (pid, net, mnt, uts, ipc, user) provide isolation, and cgroups enforce resource limits. A union filesystem such as overlay2 stacks image layers efficiently.

6. What happens when you run docker run nginx?

The CLI sends a request to the Docker daemon. If the image is not present locally, the daemon pulls it from the registry. It then creates a container from the image, sets up networking and the writable layer, and starts the image's default command.

Summary

• Docker packages applications into portable images and runs them as isolated containers.
• Containers share the host kernel, which makes them lighter and faster than VMs but less isolated.
• Core building blocks are images, containers, Dockerfiles, registries, volumes, and networks.
• Pin versions, keep containers disposable, and store state in volumes.

Continue Learning

Next: Docker Architecture