Containerization

What is Docker? Containerization Made Easy

Updated June 2026

Docker standardizes applications into lightweight, self-contained packages just like shipping containers.

Have you ever heard a developer frustratedly say: "But I swear, it works on my machine!"? This is the oldest and most annoying problem in software development. A programmer writes working code on their Mac, but when they send it to run on a Linux production server, it crashes. Docker was created to kill this problem permanently!

Let's find out how Docker containerizes software to make code work perfectly everywhere.

The Story of the Standard Shipping Container

In the 1950s, cargo shipping was a mess. Workers had to load bags of bananas, barrels of oil, and boxes of toys directly into a ship's hold. It took days, things got wet, barrels leaked, and items were crushed under heavy loads. If a train carried the goods next, everything had to be unpacked and repacked again!

Then came the Standard Shipping Container. It is a strong, metal box of a fixed size. It locks onto ships, trains, and trucks perfectly. The shipping company doesn't care what is inside—whether it's bananas or cars, they just load the standard box. It fits everywhere!

Docker is the shipping container for software. Instead of sending code files separately and hoping the server has the right Python version, you pack your code, libraries, and tools into a single digital container. This container runs identically on any computer or server on Earth!

Real-World Example: Sarah's Chatbot Crash

Sarah writes a chatbot script using Python version 3.9 and installs specific math libraries locally on her Mac. She sends the script to the operations team, but their cloud server runs an older Python version 3.6. The script crashes immediately due to incompatible syntax.

The Docker Solution: Sarah writes a recipe file called a Dockerfile. This file instructs Docker to bundle her chatbot code together with Python 3.9 and the exact math libraries. Docker packages this into a Docker Image. The server runs the image inside a container. The chatbot runs on its own internal Python 3.9 and works perfectly on the first try, ignoring the server's older version!

Docker vs Virtual Machines (VMs)

Before Docker, engineers used Virtual Machines (VMs) to run multiple apps on one server. But VMs are heavy! A VM runs a complete Operating System (like Windows or Ubuntu, costing 5-10GB of space and massive RAM) just to run a tiny 50MB script.

Docker containers share the host computer's operating system core (kernel). This makes containers ultra-lightweight. They start up in a fraction of a second and take up minimal space. You can run hundreds of containers on a single cheap server!

Core Docker Vocabulary

Dockerfile

A text file containing the step-by-step recipe to build your app (e.g. download Python, copy code, set database port).

Docker Image

The read-only, frozen snapshot built from your Dockerfile. It contains your complete app package ready to be run.

Docker Container

The active, live running instance of your image. You can start, stop, delete, and duplicate containers instantly.

Docker Hub

A public online registry (app store) where developers share pre-built images for databases (MySQL), web servers (Nginx), and more.

9 Everyday Docker Commands Every Engineer Needs

To interact with Docker, you run commands in your terminal. Here is a cheat sheet of the 9 commands you will use daily:

Purpose	Docker Command	Real-World Analogy & Example
Build Image	docker build -t <name> .	Follows the Dockerfile recipe to bake a frozen image package. Example: `docker build -t my-chatbot .`
Run Container	docker run -d -p <ports> <image>	Spins up a live, running container from an image in the background. Example: `docker run -d -p 80:80 nginx`
List Running Containers	docker ps	Lists all active, running containers currently on the computer. Example: `docker ps` (Or `docker ps -a` for all).
Stop Container	docker stop <id>	Sends a stop signal to pause and shut down a running container. Example: `docker stop a1b2c3d4`
List Local Images	docker images	Lists all frozen images downloaded or built locally on your machine. Example: `docker images`
Download Image	docker pull <image>	Downloads a pre-built image from Docker Hub (like downloading Nginx or MySQL). Example: `docker pull ubuntu`
Upload Image	docker push <image>	Uploads your custom build image to Docker Hub so others can use it. Example: `docker push my-username/my-chatbot`
Enter Container	docker exec -it <id> bash	Opens a terminal shell inside the running container to debug files. Example: `docker exec -it a1b2c3d4 bash`
Delete Container	docker rm <id>	Deletes a stopped container to free up disk space. Example: `docker rm a1b2c3d4`

Pro-Tip for Docker Space

Docker images and containers can consume massive disk space over time. Keep your machine clean by running docker system prune -a to delete all unused images, stopped containers, and cache files safely in one click!

Next Steps on Your DevOps Journey

Now that you can containerize your code and run standard boxes with Docker, you face a new question: How do we manage, coordinate, and scale thousands of these containers across a massive cloud data centre? The answer is Kubernetes orchestration!

Test Your Knowledge

Answer these 35 questions to check your understanding of this module. Click on an option to reveal the correct answer instantly.

Question 1 of 35

Which command builds an image from a Dockerfile?

A. docker create

B. docker build

C. docker run

D. docker make

Explanation: docker build creates an image from a Dockerfile.

Question 2 of 35

Which command lists running containers?

A. docker list

B. docker ps

C. docker run

D. docker show

Explanation: docker ps lists running containers.

Question 3 of 35

How do you stop a container?

A. docker end

B. docker stop

C. docker halt

D. docker kill

Explanation: docker stop gracefully stops a container.

Question 4 of 35

What file is used to define a multi-container application?

A. Dockerfile

B. docker-compose.yml

C. config.json

D. package.json

Explanation: Docker Compose uses a YAML file to define multi-container apps.

Question 5 of 35

Which command removes all stopped containers?

A. docker clean

B. docker rm

C. docker container prune

D. docker delete

Explanation: docker container prune removes all stopped containers.

Question 6 of 35

What does -d flag do in "docker run"?

A. Debug mode

B. Detached mode

C. Delete on exit

D. Direct mode

Explanation: -d runs the container in the background (detached).

Question 7 of 35

Which command downloads an image from a registry?

A. docker get

B. docker pull

C. docker fetch

D. docker load

Explanation: docker pull downloads an image from a registry like Docker Hub.

Question 8 of 35

How do you view logs of a container?

A. docker logs

B. docker view

C. docker history

D. docker show

Explanation: docker logs [container_id] fetches the logs.

Question 9 of 35

What is a Docker Volume?

A. Network config

B. Persistent data storage

C. CPU limit

D. Memory limit

Explanation: Volumes are the preferred mechanism for persisting data.

Question 10 of 35

Which command executes a command inside a running container?

A. docker run

B. docker enter

C. docker exec

D. docker attach

Explanation: docker exec runs a new command in a running container.

Question 11 of 35

What is "FROM" in a Dockerfile?

A. The maintainer

B. The base image

C. The source code

D. The destination

Explanation: FROM initializes a new build stage and sets the Base Image.

Question 12 of 35

Which command lists all images locally?

A. docker images

B. docker list-images

C. docker show

D. docker ps

Explanation: docker images (or docker image ls) lists top-level images.

Question 13 of 35

How do you map a port in docker run?

A. -p host:container

B. -port host:container

C. -m host:container

D. -map host:container

Explanation: -p (or --publish) maps a container port to a host port.

Question 14 of 35

What is a .dockerignore file?

A. Lists errors to ignore

B. Lists files to exclude from the build context

C. Lists ignored containers

D. Lists ignored networks

Explanation: It excludes files and directories from the build context.

Question 15 of 35

Which command removes an image?

A. docker rm

B. docker rmi

C. docker del

D. docker remove

Explanation: docker rmi removes one or more images.

Question 16 of 35

What is Docker Swarm?

A. A virus

B. A container orchestration tool

C. A networking driver

D. A storage driver

Explanation: Docker Swarm is a container orchestration tool native to Docker.

Question 17 of 35

Which network driver is default for containers?

A. host

B. bridge

C. overlay

D. none

Explanation: The default network driver for containers is bridge.

Question 18 of 35

What does "docker inspect" do?

A. Checks container health

B. Returns low-level information

C. Debugs code

D. Inspects file system

Explanation: It returns detailed information on Docker objects.

Question 19 of 35

How to tag an image?

A. docker label

B. docker tag

C. docker name

D. docker mark

Explanation: docker tag creates a tag TARGET_IMAGE that refers to SOURCE_IMAGE.

Question 20 of 35

What is "COPY" in Dockerfile?

A. Copies from one container to another

B. Copies local files to the image

C. Duplicates the image

D. Copies files from URL

Explanation: COPY copies new files/directories from to the filesystem of the container.

Question 21 of 35

Which command pushes an image to a registry?

A. docker upload

B. docker send

C. docker push

D. docker commit

Explanation: docker push uploads an image to a registry.

Question 22 of 35

What does "docker login" do?

A. Starts the daemon

B. Authenticates with a registry

C. Connects to a container

D. Logs container output

Explanation: It logs in to a Docker registry.

Question 23 of 35

What is an "overlay" network?

A. Default network

B. Connects multiple Docker daemons

C. Local network only

D. Testing network

Explanation: Overlay networks connect multiple Docker daemons (Swarm/K8s).

Question 24 of 35

Which instruction executes a command during the build process?

A. CMD

B. RUN

C. ENTRYPOINT

D. EXEC

Explanation: RUN executes commands in a new layer and commits the results.

Question 25 of 35

How to restart a container?

A. docker reload

B. docker restart

C. docker boot

D. docker reset

Explanation: docker restart stops and then starts the container.

Question 26 of 35

What is the difference between COPY and ADD instructions in a Dockerfile?

A. COPY compiles code; ADD only transfers text files.

B. ADD can fetch files from remote URLs and extract local tarballs; COPY is restricted to local copies.

C. COPY runs as root; ADD runs as guest.

D. ADD is a newer instruction that deprecates COPY.

Explanation: ADD has extra features to fetch URLs and unpack archive files automatically. COPY is preferred for simple file transfers to reduce side-effects.

Question 27 of 35

How do ENTRYPOINT and CMD instructions interact when both are defined in a Dockerfile?

A. CMD overrides ENTRYPOINT entirely.

B. ENTRYPOINT defines the executable, and CMD provides default arguments appended to it.

C. ENTRYPOINT runs in the background; CMD runs in the foreground.

D. They execute in parallel thread environments.

Explanation: ENTRYPOINT sets the primary target command. CMD provides arguments that the user can easily override on runtime (e.g. docker run image overridden-arg).

Question 28 of 35

What is a key difference between Docker Volumes and Bind Mounts?

A. Volumes are managed by Docker storage drivers; Bind Mounts map directly to any path on the host system.

B. Bind Mounts perform much faster than Volumes on macOS.

C. Volumes are deleted automatically when containers stop.

D. Bind Mounts do not support write access.

Explanation: Volumes are hosted in isolated Docker-managed storage directories (e.g. /var/lib/docker/volumes). Bind Mounts bind directory structures directly on the host system.

Question 29 of 35

What is the primary benefit of using Multi-Stage Builds in a Dockerfile?

A. It speeds up the initial base image downloads.

B. It reduces the final image size by copying only build artifacts, discarding compile-time SDK tools.

C. It allows running multiple containers simultaneously.

D. It enables multi-threading on single-core hosts.

Explanation: Multi-stage builds use multiple FROM lines to compile code in intermediary layers, and copy output binaries to a tiny runtime base image.

Question 30 of 35

Which network driver binds a container directly to the host system's network interface without isolation?

A. bridge

B. host

C. overlay

D. macvlan

Explanation: Under the host network driver, the container shares the host network namespace without network address translation (NAT).

Question 31 of 35

What happens when a container exceeds its hard memory limit configured via '--memory'?

A. Docker throttles the container CPU.

B. The container is terminated by the kernel's Out-Of-Memory (OOM) killer.

C. Docker auto-scales the memory limit.

D. The container swaps memory to index files.

Explanation: Exceeding hard memory limits triggers the Linux kernel Out-Of-Memory (OOM) killer, terminating the offending processes instantly.

Question 32 of 35

How can you optimize Docker image build caching for application dependency layers?

A. Run all command instructions using a single RUN block.

B. Copy dependency definitions (package.json/requirements.txt) and run install commands before copying source code.

C. Place the COPY source-code line at the top of the Dockerfile.

D. Turn off caching using a Docker config daemon rule.

Explanation: Placing static files like package lists at the top ensures layer caching keeps dependencies cached unless the list itself changes.

Question 33 of 35

In Docker Compose, what is a limitation of the "depends_on" option by default?

A. It cannot depend on more than one container.

B. It only guarantees container startup order, not that the service is healthy or fully ready.

C. It forces container rebuilding dynamically.

D. It binds networking paths on bridge mode only.

Explanation: depends_on coordinates the boot order. To check if a service is actually ready, you must configure a healthcheck logic.

Question 34 of 35

Why does writing large quantities of logs directly inside container folders decrease performance?

A. Docker locks files automatically on write.

B. Writing inside container layers uses copy-on-write storage drivers (like overlay2), creating performance overhead.

C. Docker limits file sizes in root directories to 1MB.

D. The overlay network logs all disk changes on runtime.

Explanation: Writing inside the container filesystem layer requires copy-on-write actions. I/O-intensive workloads should use volumes or bind mounts instead.

Question 35 of 35

What is the security advantage of Rootless Mode in Docker?

A. The Docker daemon and containers run as a non-root user, reducing host vulnerability risks.

B. It disables root SSH access inside container images.

C. It encrypts all network packets passing over the overlay interface.

D. Containers cannot execute bash or sh binaries.

Explanation: Rootless mode mitigates security risks because a container breakout does not immediately grant root administrative access to the host machine.

Real-Time Interview Questions & Answers

1. What is the difference between a Docker Image and a Docker Container?

Answer: A Docker Image is a read-only, static blueprint containing all libraries and files. A Docker Container is a live, running instance of an image with a read-write layer on top.

Example: “In our registry, we store our application image `web-app:v1.0`, and run multiple container instances of it on our staging server.”

2. What are Docker Volumes, and when should we use them?

Answer: Docker Volumes are storage mechanisms designed to persist container data outside the container file system. Without volumes, all data generated inside a container is lost when the container is deleted.

Example: “We mount a named volume for our PostgreSQL containers using `docker run -v db_data:/var/lib/postgresql/data` to ensure data persists during upgrades.”

3. What is the difference between the COPY and ADD instructions in a Dockerfile?

Answer: `COPY` only supports copying local files and directories from the host build context. `ADD` can copy remote files via URLs and automatically extract tar archives into the image.

Example: “I always use `COPY` for standard file additions to keep builds predictable, and only use `ADD` when importing local tar archive components.”

4. How do you troubleshoot a Docker container that exits immediately after starting?

Answer: I start by running `docker logs ` to check stdout/stderr, then run `docker inspect ` to verify the CMD, ENTRYPOINT, and exit codes.

Example: “I resolved a startup crash by running `docker logs` and finding that the application was missing database environment variables.”

5. How do you run commands inside an already running Docker container?

Answer: I use the `docker exec` command along with `-it` (interactive tty) flags to spawn a bash or sh shell inside the running container namespace.

Example: “I run `docker exec -it my-nginx /bin/bash` to verify if NGINX configuration files are correctly loaded inside the container.”

6. What is Docker Compose, and when should you use it?

Answer: Docker Compose is a tool for defining and running multi-container Docker applications. It uses a YAML file to configure application services, networks, and volumes in one place.

Example: “We use a `docker-compose.yml` file to spin up our Node.js app, Redis cache, and MongoDB database together for local testing.”

7. How do Docker Image Layers work, and how can we optimize image builds?

Answer: Each instruction in a Dockerfile (like RUN, COPY, ADD) creates a read-only layer. Docker caches layers to speed up builds. We can optimize by combining commands and putting infrequently changed layers at the top.

Example: “I combine commands like `apt-get update && apt-get install -y curl` to avoid creating unnecessary intermediate layers in our images.”

8. What is the difference between CMD and ENTRYPOINT in a Dockerfile?

Answer: `ENTRYPOINT` sets the primary executable of the container, which cannot be easily overridden. `CMD` provides default arguments for the entrypoint, which can be overridden at runtime.

Example: “We define `ENTRYPOINT ['node']` and `CMD ['server.js']` so developers can run the image or override parameters to run tests.”

9. How do you publish a port in Docker, and what is the difference between exposing and publishing?

Answer: `EXPOSE` is informational, documenting which ports the container listens on. Publishing a port using `-p :` maps the host port to the container port, opening access to the outside.

Example: “I map a container port using `docker run -p 80:8080 my-app` to expose our internal Node.js port 8080 on the host’s standard port 80.”

10. How do you push a local Docker image to a registry like Amazon ECR or Docker Hub?

Answer: I tag the image with the registry host name using `docker tag`, log in to the registry with `docker login`, and push the tagged image using `docker push`.

Example: “I run `docker tag local-app:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/app:v1` then push it to deploy it to AWS.”

11. What is the default Docker bridge network, and how do containers communicate?

Answer: The default `bridge` network connects containers on the same host. Containers on the default bridge can only communicate via IP addresses. On custom bridge networks, they can communicate using container names as hostnames (automatic DNS).

Example: “We create a user-defined bridge network `docker network create app-net` so our app container can connect to `db-container:5432` easily.”

12. How do you limit resource usage (CPU and Memory) for Docker containers?

Answer: I specify limits using flags like `-m` or `--memory` and `--cpus` in the `docker run` command, or define resource limits in docker-compose files.

Example: “I run `docker run -d -m 512m --cpus=0.5 nginx` to restrict our web container from consuming more than 512MB of RAM.”

13. What is a multi-stage Docker build, and what are its advantages?

Answer: A multi-stage build uses multiple `FROM` instructions in a single Dockerfile. It compiles dependencies in a build stage, and copies only the output artifact to a clean production stage, reducing image size.

Example: “We use multi-stage builds to compile our Go app in a 800MB golang container, then copy the binary into a 5MB alpine image for deployment.”

14. How do you configure a Docker container to start automatically if it crashes or the host reboots?

Answer: I configure restart policies using the `--restart` flag in `docker run` (e.g., `always`, `unless-stopped`, `on-failure`).

Example: “We run our critical service containers with the `--restart unless-stopped` flag to survive host server updates and unexpected failures.”

15. How do you clean up unused containers, images, volumes, and networks to free up disk space?

Answer: I use the `docker system prune` command, which deletes stopped containers, unused networks, and dangling images. Adding `--volumes` cleans up unused volume space.

Example: “I run `docker system prune -a --volumes -f` in our Jenkins cron job to clean up disk space between automated builds.”

Live Sandbox

Don't Just Read. Code Live!

Practice what you just learned in our secure, zero-setup interactive labs. Boot up Linux containers, orchestrate AWS infrastructure, and run Docker right in your browser.

100% Free & Interactive for Growth School Community No Setup Required Real-time Terminal Feedback

Start Live Sandbox

ubuntu@growthschool:~

docker run -d -p 80:80 nginx

Unable to find image 'nginx:latest' locally...

latest: Pulling from library/nginx

Digest: sha256:4c087b3289aa6b185...

Status: Downloaded newer image for nginx:latest

Container running at http://localhost:80