Docker is one of the most important tools used in DevOps and cloud engineering. It helps teams package applications with their required files and dependencies so they can run consistently across development, testing, and production environments.
Your original notes correctly identify images, containers, Dockerfiles, Docker Hub, volumes, port mapping, Compose, and common Docker tasks as the core learning areas.
What Is Containerization?
Containerization is the process of packaging an application together with its runtime, libraries, configuration, and dependencies.
The packaged application runs inside an isolated environment called a container.
A container is not a complete virtual machine. It is an isolated process that uses a container image for its files and configuration. (Docker Documentation)
Simple Example –
Suppose a Java application requires:
- Java 21
- Tomcat
- Application WAR file
- Configuration files
- Required libraries
Docker packages these components into an image. The same image can then run on a developer laptop, test server, AWS EC2 instance, or CI/CD environment.
This reduces the common problem:
“The application works on my machine but not on the server.”
What Is Docker?
Docker is a containerization platform used to build, share, and run containerized applications.
Docker Engine follows a client-server architecture:
- Docker CLI: Accepts commands such as
docker buildanddocker run - Docker daemon: Builds images and manages containers, networks, and volumes
- Docker API: Connects the CLI and other tools to the daemon (Docker Documentation)
Why Is Docker Used?
Docker provides several practical benefits:
- Consistent application environments
- Faster application deployment
- Better resource utilization
- Easy application portability
- Reusable images
- Process isolation
- Simple CI/CD integration
- Fast development and testing environments
Containers usually require fewer resources than virtual machines because every container does not need its own complete guest operating system. (IBM)
Docker’s Main Components
| Component | Purpose |
|---|---|
| Dockerfile | Instructions used to build an image |
| Image | Read-only package containing application files and dependencies |
| Container | Running instance of an image |
| Docker Engine | Builds and manages images and containers |
| Docker Hub | Registry used to store and share images |
| Volume | Persistent storage for container data |
| Network | Allows containers and external users to communicate |
Docker Image vs. Docker Container
| Docker image | Docker container |
|---|---|
| Read-only blueprint | Running instance of an image |
| Built from a Dockerfile | Created using docker run |
| Stored in a registry | Runs on a Docker host |
| Made of immutable layers | Adds a writable container layer |
| Can create many containers | Represents one running application instance |
A container image contains the files, binaries, libraries, and configuration needed to run a container. Images are immutable and built from reusable layers. (Docker Documentation)
Interview answer
An image is a read-only application blueprint. A container is a running instance of that image.
What Is a Dockerfile?
A Dockerfile is a text file containing instructions that Docker uses to build an image.
Common instructions include:
| Instruction | Purpose |
|---|---|
FROM | Selects the base image |
WORKDIR | Sets the working directory |
COPY | Copies application files |
RUN | Runs commands during image creation |
ENV | Defines environment variables |
EXPOSE | Documents the container’s intended port |
CMD | Provides the default startup command |
ENTRYPOINT | Defines the main executable |
Docker normally builds images from Dockerfiles because this method is repeatable, version-controlled, and suitable for automation. (Docker Documentation)
Simple Dockerfile Example
Create an index.html file:
<h1>Hello from Docker!</h1>
Create a file named Dockerfile:
FROM nginx:alpine
COPY index.html /usr/share/nginx/html/index.html
EXPOSE 80
Build the image:
docker build -t my-web-app:1.0 .
Run a container:
docker run -d \
--name web-container \
-p 8080:80 \
my-web-app:1.0
Open:
http://localhost:8080
In -p 8080:80:
8080is the host port80is the container port
EXPOSE 80 documents the expected container port. The -p option creates the actual host-to-container port mapping. (Docker Documentation)
What Is Docker Hub?
Docker Hub is a container registry used to find, store, and share container images.
It supports:
- Public repositories
- Private repositories
- Docker Official Images
- Verified Publisher images
- Image tags and versions
- Team collaboration
Docker Hub allows developers to pull existing images or distribute their own custom images. (Docker Documentation)
Docker Workflow
The standard Docker workflow is:
Application code
↓
Dockerfile
↓
docker build
↓
Docker image
↓
docker run
↓
Docker container
↓
docker push
↓
Docker Hub or private registry
Another server can then pull the same image and create an identical container.
Push an Image to Docker Hub
1. Log in
docker login
2. Tag the image
Replace yourusername with your Docker Hub username:
docker tag my-web-app:1.0 yourusername/my-web-app:1.0
3. Push the image
docker push yourusername/my-web-app:1.0
4. Pull the image on another machine
docker pull yourusername/my-web-app:1.0
5. Run the downloaded image
docker run -d \
--name web-container \
-p 8080:80 \
yourusername/my-web-app:1.0
Docker image names normally follow this structure:
registry/namespace/repository:tag
For Docker Hub, the namespace is normally the user or organization name. Authentication is required before pushing an image. (Docker Documentation)
Important Docker Commands
| Command | Purpose |
|---|---|
docker pull nginx | Download an image |
docker image ls | List local images |
docker build -t app:1.0 . | Build an image |
docker run -d app:1.0 | Create and start a container |
docker ps | Show running containers |
docker ps -a | Show all containers |
docker logs container-name | View application logs |
docker exec -it container-name sh | Enter a running container |
docker inspect container-name | View detailed configuration |
docker stop container-name | Stop a container |
docker rm container-name | Remove a container |
docker rmi image-name | Remove an image |
Use docker exec when you need to run a new command inside an existing container. docker attach connects directly to the container’s main process and is less suitable for normal troubleshooting.
Docker Volumes
Container writable data may be lost when the container is removed.
Docker volumes store data separately from the container lifecycle.
Create a volume:
docker volume create website-data
Use the volume:
docker run -d \
--name web-container \
-p 8080:80 \
-v website-data:/usr/share/nginx/html \
nginx:alpine
Volumes are useful for:
- Database files
- Uploaded documents
- Application-generated data
- Shared container data
- Backups and migrations
Docker recommends volumes for persistent data managed by Docker. Use bind mounts when the host must directly access and modify the files. (Docker Documentation)
Docker Networking
Docker networking allows containers to communicate with each other.
Create a network:
docker network create app-network
Run containers on the network:
docker run -d \
--name backend \
--network app-network \
backend-image:1.0
Containers connected to the same user-defined network can communicate using container names instead of fixed IP addresses. (Docker Documentation)
Important difference
- Container-to-container communication: Use a Docker network
- External access: Use port publishing such as
-p 8080:80
What Is Docker Compose?
Docker Compose defines and runs multi-container applications using a YAML file.
A Compose file can define:
- Application services
- Networks
- Volumes
- Environment variables
- Port mappings
Start the application:
docker compose up -d
Stop and remove it:
docker compose down
Compose is useful when an application includes multiple components, such as a frontend, backend, and database. (Docker Documentation)
Docker vs. Virtual Machines
| Docker containers | Virtual machines |
|---|---|
| Share an operating-system kernel | Include a complete guest OS |
| Start quickly | Usually take longer to boot |
| Use fewer resources | Require more CPU, memory, and storage |
| Package applications | Virtualize complete machines |
| Best for portable application deployment | Best for strong OS-level separation |
Docker does not completely replace virtual machines. Companies commonly run Docker containers inside cloud virtual machines.
Interview answer
Virtual machines virtualize hardware and run complete operating systems. Containers virtualize the operating-system level and package applications with their dependencies.
Real-World Docker CI/CD Workflow
A common DevOps workflow is:
- Developer pushes code to GitHub.
- Jenkins or GitHub Actions starts the pipeline.
- The pipeline runs tests.
- Docker builds an image.
- The image is scanned for vulnerabilities.
- The pipeline tags the image with a version or commit ID.
- The image is pushed to Docker Hub or a private registry.
- The deployment server pulls and runs the approved image.
This provides consistent and repeatable deployments across environments.
Docker Security Best Practices
- Use Docker Official or Verified Publisher images
- Use small and trusted base images
- Avoid using only the
latesttag - Tag images with clear versions
- Run applications as non-root users
- Never store passwords or API keys inside images
- Use
.dockerignoreto exclude unnecessary files - Use multi-stage builds for smaller production images
- Regularly rebuild and scan images
- Do not expose unnecessary ports
Docker recommends trusted, minimal base images and regular rebuilding to reduce unnecessary dependencies and vulnerabilities. (Docker Documentation)
Build arguments and environment variables should not be used to permanently store secrets because they may remain visible in image metadata or layers. (Docker Documentation)
Common Docker Problems
Container stops immediately
Check logs:
docker logs container-name
The main container process may have failed or completed.
Website is not accessible
Check:
docker ps
docker port container-name
Verify the port mapping, host firewall, cloud security group, and application listening port.
Docker Hub push is denied
Check:
docker login
Make sure the image name includes the correct Docker Hub username:
yourusername/repository:tag
Image cannot be removed
Check for dependent containers:
docker ps -a
Remove the containers before deleting the image.
Data disappears after container removal
Use a named volume instead of storing important data only in the container layer.
Important Docker Interview Questions
What is Docker?
Docker is a platform used to build, share, and run applications inside containers.
What is a container?
A container is an isolated running process created from a container image.
What is the difference between an image and a container?
An image is a read-only blueprint. A container is a running instance of that image.
What is Docker Hub?
Docker Hub is a registry used to store, distribute, pull, and push container images.
What is a Dockerfile?
A Dockerfile contains instructions used to build a Docker image.
What is port mapping?
Port mapping connects a host port to a container port so external users can access the containerized application.
Why are volumes required?
Volumes store persistent data outside the container’s writable layer.
What is the difference between COPY and ADD?
COPY copies local files into an image. ADD provides additional behaviors. Use COPY for normal file-copying requirements.
What is the difference between CMD and ENTRYPOINT?
ENTRYPOINT defines the main executable. CMD provides a default command or default arguments that users can override.
Why should Dockerfiles be stored in Git?
Git provides version history, peer review, collaboration, rollback, and CI/CD integration.
Conclusion
Docker packages applications into portable containers, while Docker Hub stores and distributes the images used to create those containers.
For DevOps jobs, focus on this workflow:
Write Dockerfile → Build image → Run container → Test → Tag → Push to registry → Deploy