The Ultimate Knowledge Hub
Answer: Docker is a platform for developing, shipping, and running applications in containers. Unlike virtual machines (which virtualize hardware), Docker virtualizes the OS, making it lightweight and faster to start.
| Feature | Virtual Machine | Docker |
|---|---|---|
| Virtualizes | Hardware | OS level |
| Startup Time | Minutes | Seconds |
| Resource Use | Heavy | Lightweight |
Answer: A Docker image is a read-only template containing the application code, libraries, dependencies, and instructions needed to create a container.
Answer: By writing a Dockerfile and running docker build.
Example:
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["npm", "start"]
Run:
docker build -t my-node-app .
Answer: A Docker container is a runnable instance of a Docker image. It includes the app and its environment, isolated from the host.
Run a container:
docker run -d -p 3000:3000 my-node-app
CMD and ENTRYPOINT in Docker.Answer: Both define the command to run inside a container, but ENTRYPOINT is not overridden by command-line arguments, while CMD is.
Example:
ENTRYPOINT ["echo"]
CMD ["Hello"]
Running:
docker run myimage World
Output: echo World
docker ps
To see all containers:
docker ps -a
docker stop <container_id>
docker stop and docker kill?Answer: docker stop sends a SIGTERM and allows graceful shutdown; docker kill sends SIGKILL and forces immediate stop.
docker rm <container_id>
Remove all stopped containers:
docker container prune
docker rmi <image_id>
Answer: Docker Hub is a cloud-based repository where Docker users can share, store, and distribute images.
Answer: Volumes are Docker-managed directories stored on the host to persist data outside containers.
Mount a volume:
docker run -v my_volume:/data busybox
| Feature | Bind Mounts | Volumes |
|---|---|---|
| Managed by | User | Docker |
| Path specified | Absolute path | Named or anonymous |
| Backups | Manual | docker volume command |
Answer: Docker builds layers in the order of instructions. Changing early layers causes rebuilding of all subsequent layers.
Answer: It allows using multiple FROM instructions to reduce final image size by copying only needed artifacts to the final stage.
Example:
FROM golang:1.18 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM alpine
COPY --from=builder /app/myapp /myapp
CMD ["/myapp"]
| Network Type | Use case |
|---|---|
| bridge | Default, single-host |
| host | Shares host network |
| overlay | Multi-host swarm |
| none | No networking |
docker network create mynet
docker run --network=mynet myimage
Answer: A context lets you switch between different Docker environments (e.g., local, remote servers).
List:
docker context ls
Use:
docker context use mycontext
COPY and ADD in Dockerfile?| COPY | ADD |
|---|---|
| Copies files/directories | Copies + supports URL, tar extraction |
Prefer COPY unless you need extra ADD features.
docker run -e VAR_NAME=value myimage
Or in Dockerfile:
ENV VAR_NAME value
docker exec vs docker attach.Answer:
docker exec: runs a command in a running container.
docker attach: connects your terminal to container's main process.
Use exec for isolated command; attach to interact directly.
Answer: An image not tagged or referenced by any container, usually intermediate build layers.
Clean:
docker image prune
Answer: Native Docker clustering tool for managing multiple Docker hosts as a single virtual system.
Initialize:
docker swarm init
docker service scale myservice=5
docker inspect <container_id>
docker run --memory="500m" --cpus="1.5" myimage
.dockerignore file?Answer: Works like .gitignore to exclude files from the build context.
Example:
node_modules
*.log
Answer: A tool to define and run multi-container Docker apps using docker-compose.yml.
Example docker-compose.yml:
version: '3'
services:
web:
image: nginx
ports:
- "8080:80"
db:
image: mysql
environment:
MYSQL_ROOT_PASSWORD: example
Run:
docker-compose up -d
docker-compose up and docker-compose up --build?Answer: up --build forces rebuilding images before starting containers.
By using a named volume:
docker run -v db_data:/var/lib/mysql mysql
docker save and docker export?Answer:
docker save: saves an image (with layers and metadata) to a tar archive.
docker export: exports a container's filesystem as a tar archive without metadata.
Export:
docker save myimage > myimage.tar
Import:
docker load < myimage.tar
docker cp <container_id>:/path/in/container /host/path
always vs unless-stopped?| Policy | Behavior |
|---|---|
| always | Always restarts |
| unless-stopped | Restart unless explicitly stopped |
Answer: Images are composed of immutable layers; containers are runnable instances that add a writable layer on top of the image layers.
docker system prune
docker run nginx.Answer:
Docker checks for nginx image locally.
If not found, pulls from registry.
Creates container from image.
Starts container with default command.
docker run --log-driver=json-file myimage
Available drivers: json-file, syslog, journald, gelf, fluentd, awslogs.
docker logs <container_id>
docker build --progress=plain --no-cache .
Also use docker history <image> to inspect layers.
Answer: Used to determine container health status.
In Dockerfile:
HEALTHCHECK CMD curl --fail http://localhost:8080 || exit 1
Answer: A container that runs alongside a main application container, providing auxiliary functionality (logging, monitoring, proxy).
docker exec -it <container_id> /bin/bash
If bash missing, try /bin/sh.
You can't directly update; you need to:
Commit changes:
docker commit <container_id> myupdatedimage
Run new container from updated image.
Depends on OS:
overlay2 on most Linux distros.
windowsfilter on Windows.
Check:
docker info | grep Storage
docker history <image>
0: successful execution
Non-zero: error code from process
Check exit code:
docker inspect --format='{{.State.ExitCode}}' <container>
docker-compose down and docker-compose stop?| Command | Effect |
|---|---|
| stop | Stops containers |
| down | Stops + removes containers, networks, volumes |
Docker caches intermediate layers to speed up rebuilds; changes to earlier layers invalidate cache for later ones.
docker run myimage mycustomcommand
Answer: By using Docker Content Trust (DCT) and Notary.
Enable DCT:
env DOCKER_CONTENT_TRUST=1 docker push myimage
Answer: DCT ensures image authenticity and integrity via signing; scanning tools check for vulnerabilities in images.
Answer: By setting DOCKER_CONTENT_TRUST=1 globally on the Docker client or in CI pipelines.
Answer: Write a plugin following Docker's plugin API and register it using:
docker plugin install <plugin-name>
docker network create --driver=<plugin-name> mynet
Answer: Seccomp (secure computing mode) is a Linux kernel feature to restrict system calls inside containers. Docker uses a default seccomp profile for added security.
docker run --security-opt seccomp=/path/to/profile.json myimage
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myimage
Answer: A Docker daemon that runs without root privileges, improving security by reducing attack surface.
Follow official Docker rootless installation:
curl -fsSL https://get.docker.com/rootless | sh
Answer: Layers are immutable file system changes; Docker caches unchanged layers to avoid rebuilding.
Use smaller base images (alpine)
Minimize layers
Use .dockerignore
Multi-stage builds
Answer: An empty base image useful for building minimal containers (e.g., statically compiled Go binaries).
Export:
docker run --rm -v myvol:/volume -v $(pwd):/backup busybox tar czf /backup/backup.tar.gz -C /volume .
Import:
docker run --rm -v myvol:/volume -v $(pwd):/backup busybox tar xzf /backup/backup.tar.gz -C /volume
docker run --ulimit nofile=1024:2048 myimage
docker system df
| Feature | Swarm | Kubernetes |
|---|---|---|
| Setup complexity | Low | High |
| Features | Basic | Extensive |
| Ecosystem | Docker-native | Broad |
docker secret create mysecret ./mysecret.txt
docker service create --secret mysecret nginx
Secrets are immutable; create a new secret and update the service with the new secret.
docker stats
Prometheus + cAdvisor
3rd-party tools like Datadog, Grafana, ELK.
Answer: Low-level software to run containers. Examples: runc, containerd, cri-o.
logging:
driver: syslog
options:
syslog-address: "tcp://192.168.0.42:123"
Answer: Key-value metadata used to organize and filter containers.
docker run --label environment=dev myimage
docker ps --filter label=environment=dev
services:
web:
image: nginx
deploy:
resources:
limits:
cpus: '0.50'
memory: 512M
Answer: BuildKit is a modern build engine offering faster builds, parallelization, and better caching.
Enable:
DOCKER_BUILDKIT=1 docker build .
docker run --privileged -d docker:dind
Compose uses entrypoint: and command: keys; entrypoint overrides image ENTRYPOINT, command overrides CMD.
Use --read-only filesystem
Limit mounts
Control device access via --device
Use tcpdump or Wireshark inside container or attach to bridge interface on host.
docker exec -it <container> sh
Check logs, process tree, network connections.
Running as root
Privileged containers
Exposed daemon socket
Untrusted images
Use signed images
Verify checksums
Pull only from trusted registries
Answer: Linux namespaces isolate resources (PID, net, IPC, mnt, UTS) between containers.
Answer: Linux control groups to limit and account resources (CPU, memory, I/O) for containers.
Edit /etc/docker/daemon.json:
{
"data-root": "/mnt/docker-data"
}
Restart daemon.
soft and hard memory limits?Answer: Docker uses kernel memory limits; soft is an advisory, hard is enforced. Docker enforces --memory as hard limit.
docker network create --opt encrypted --driver overlay my_overlay
docker system prune -a
Set environment file /etc/systemd/system/docker.service.d/http-proxy.conf:
[Service]
Environment="HTTP_PROXY=http://proxy.example.com:80/"
Reload systemd:
systemctl daemon-reload
systemctl restart docker
docker volume prune
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' <container>
Edit /etc/docker/daemon.json:
{
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
}
Answer: Containers following the Open Container Initiative specification (standard for image format and runtime).
Answer: A SHA256 hash uniquely identifying an image's content.
Pull by digest:
docker pull nginx@sha256:abc123...
restart: unless-stopped
On manager:
docker node rm <node>
On worker:
docker swarm leave
Use docker build --no-cache
Check .dockerignore
Analyze docker history
Answer: A plugin defining build language; default is Dockerfile frontend.
Answer: Temporary containers for debugging running pods.
docker events --since 1h