Docker and Container Fundamentals

Cloud and DevOps path · Step 1Available

Package a small service reproducibly and understand what Docker does—and does not— isolate.

Difficulty: Beginner–Intermediate
Time: 75 min
Practice: Build and inspect a small image
Assessment: Knowledge check

Before you start

Who is this for?

For developers, administrators, and learners moving from local applications toward reproducible environments.

Prerequisites

Basic Linux command-line use
Basic networking concepts

What you'll be able to do

Distinguish images, containers, volumes, and networks
Read a Dockerfile
Publish a port safely
Inspect logs and container state
Recognize common image and permission mistakes

Practical outcome

You can run, inspect, and remove a disposable web service without confusing host and container ports.

1. The container mental model

A container is an isolated process, not a small virtual machine. It uses the host kernel while its image provides a filesystem, application, and dependencies. Isolation, namespaces, resource controls, and a read-only image layer make the process reproducible; they do not automatically make an application secure.

A Dockerfile describes how to build an image. An image is an immutable set of layers. A container is a running instance of an image. A volume stores data outside the disposable container layer. A network provides controlled connectivity between containers and the host.

Important boundary: publishing 8080:80 means host port 8080 forwards to container port 80. It does not change what the application listens on inside the container.

2. Run and inspect a disposable service

Use a test machine and remove the container afterward:

docker run --name bytepath-web --detach --publish 8080:80 nginx
docker ps
docker logs bytepath-web
docker inspect bytepath-web
docker stop bytepath-web
docker rm bytepath-web

Expected result: the host can request http://localhost:8080, while the process inside the container still listens on port 80. docker inspect reveals the image, network, mounts, and port mapping. Logs are application output; they are not a substitute for checking the container state.

3. Build a minimal image

Create a directory containing index.html and this Dockerfile:

FROM nginx:alpine
COPY index.html /usr/share/nginx/html/index.html
EXPOSE 80

Build and run it:

docker build --tag bytepath-web:1.0 .
docker run --name bytepath-web --detach --publish 8080:80 bytepath-web:1.0
curl --fail http://localhost:8080/

EXPOSE documents the intended container port; --publish creates the host mapping. Use a .dockerignore file to avoid copying credentials, build output, and local caches into the build context.

4. Storage and configuration

The writable container layer disappears when the container is removed. Use a named volume for data that must outlive the process:

docker volume create bytepath-data
docker run --rm --mount source=bytepath-data,target=/data alpine sh -c 'echo saved >/data/result.txt'
docker run --rm --mount source=bytepath-data,target=/data alpine cat /data/result.txt

Configuration belongs in environment variables or a controlled configuration mechanism, not in an image layer. Never bake passwords or tokens into a Dockerfile.

5. Networks and least privilege

A container can reach other containers on a user-defined network by service name. Publish only ports that must be reachable from the host. Use a non-root user where the image and application support it, pin or review image versions, and scan images using an approved local tool before production use.

Containers reduce packaging differences; they do not replace patching, access control, backups, monitoring, or application security.

6. Troubleshooting checklist

Container exits: inspect docker logs and the exit code; the main process may have completed or failed.
Port unreachable: compare host port, container port, bind address, firewall, and application listener.
Data disappears: check whether a volume is mounted at the expected path.
Permission denied: compare the container user, host directory ownership, and mount mode.
Image builds unexpectedly: inspect the build context, .dockerignore, cache, and exact image tag.
DNS or service discovery fails: confirm both containers share the expected user-defined network.

7. Mini-lab

Run the nginx example with a custom page, verify it with curl, inspect the port mapping, stop and remove it, then explain which data disappeared and which data would need a volume. Do not expose the service beyond your own test machine.

Knowledge check

Before moving on, explain the difference between an image, container, volume, network, host port, and container port without looking at the definitions.