DevOps line
Docker
Docker packs your app and all it needs into a sealed meal kit, so any kitchen can cook it the same way.
Stops explain each step. The film plays the whole ride.
- A step you start
- Quietly piling up
- Made or kept
- Something went wrong
You write the recipe
You write a recipe card for your app: start from a ready-made base, add the tools it needs, add your code, then say how to start it.
Next stop: The recipe becomes a kit
All stops
The everyday version
Cooking from a meal kit works the same way. Every stop has a twin in the kitchen.
- Youis the Developer
Write the recipe card and decide what to cook.
- The recipe cardis the Dockerfile
Lists every step in order: what to start from, what to add, and how to begin.
- The meal kitis the Image
A sealed box of stacked trays. Once packed it never changes, and it can make many meals.
- The shop shelfis the Registry
Keeps finished kits so any kitchen can pick one up.
- The cooked mealis the Container
One live copy made from the kit. Wash the pot and it is gone.
- The leftovers boxis the Volume
Sits outside the pot, so what is kept in it survives when the pot is washed.
- Sauce down the drainis data lost with its container
Without a leftovers box, anything left in the pot is washed away with it. Keep what matters in the box.
Interview questions
Say the short answer first. Go deeper only if they ask.
What is the difference between an image and a container?
An image is the read-only template, and a container is a running instance of it.
Many containers can run from one image, and each gets its own thin writable layer. Deleting a container deletes that layer, while the image stays unchanged.
“A container is a lightweight VM with its own kernel.”
How do image layers and the build cache work?
Each instruction adds a layer, and Docker reuses a layer while nothing it depends on has changed.
Once one layer changes, every layer after it is rebuilt. Order instructions from least to most often changed: copy requirements.txt and install before copying the source. A cached RUN is not invalidated automatically, so use --no-cache for a fresh install.
“COPY . . first, then pip install.”
What is the difference between CMD and ENTRYPOINT?
ENTRYPOINT sets the main executable, and CMD supplies its default arguments, or the default command when there is no ENTRYPOINT.
Arguments to docker run <image> replace CMD and are appended to an exec-form ENTRYPOINT; --entrypoint overrides it. Prefer exec form, ["uvicorn", "app:app"]: shell form runs under /bin/sh -c, so the app is not PID 1 and never gets the SIGTERM from docker stop.
“They are identical.”
Where should data that must survive be kept?
In a volume or a bind mount, not in the container’s writable layer.
A named volume is managed by Docker and outlives the container; a bind mount maps a host path, which suits development. docker rm never deletes a named volume, and -v only removes anonymous ones. Remove a named volume with docker volume rm.
“Data stays in the container forever.”
How do containers differ from virtual machines?
Containers share the host’s kernel, while a VM runs a full guest operating system with its own kernel.
Docker isolates each container with Linux namespaces, and cgroups can cap its CPU and memory (there are no limits by default). A container starts from an image instead of booting its own operating system, so it carries less overhead.
“Docker virtualizes the hardware.”
What does -p 8080:80 do?
It publishes container port 80 on host port 8080. The host port comes first.
By default the port is published on every host address, so outside clients can reach it, and -p 127.0.0.1:8080:80 limits it to the host itself. EXPOSE only documents a port and does not publish it. Unpublished ports are unreachable from outside the host.
“EXPOSE opens the port to the outside.”
How do containers find each other by name?
On a user-defined bridge network Docker resolves container names. On the default bridge it does not.
Run docker network create net, then start containers with --network net. They reach each other by name or alias. On the default bridge they can only use IP addresses, unless you use --link.
“Containers on the default network can call each other by name.”
What is a multi-stage build?
A Dockerfile with several FROM stages: build in one, then COPY --from only the result into a small final stage.
Compilers and build tools stay in the earlier stage, so the final image is smaller. Name a stage with AS, and build only up to one stage with --target.
“One stage with the compiler and every build tool is fine for production.”
Cheat-sheet
Commands you will actually type.
docker build -t myapp:1.0 .Build an image from the Dockerfile in this folder and tag it.
docker run -d --name api -p 8000:8000 --env-file .env myapp:1.0Run in the background, name it, publish host port 8000, and read variables from a file.
docker ps -aList containers, including stopped ones.
docker logs -f apiFollow a container’s log output.
docker exec -it api shOpen a shell inside a running container.
docker run -v data:/data myapp:1.0Mount the named volume data at `/data`. Docker creates it if it is missing.
docker network create netMake a user-defined bridge network, then start containers with `--network net` so they reach each other by name.
docker stop api && docker rm apiStop the container (SIGTERM first, SIGKILL after a grace period), then remove it.
Sources
- Docker docs: build cache
- Docker docs: cache invalidation
- Docker docs: optimize cache usage
- Docker docs: using the build cache
- Docker docs: understanding image layers
- Docker docs: what is an image
- Docker docs: what is a container
- Docker docs: what is a registry
- Docker docs: Docker overview (daemon, namespaces)
- Dockerfile reference (RUN, CMD, ENTRYPOINT, EXPOSE)
- Docker docs: Dockerfile best practices
- Docker docs: multi-stage builds
- Docker docs: build context
- Docker docs: storage overview
- Docker docs: volumes
- Docker docs: bind mounts
- Docker docs: storage drivers (container layer)
- Docker docs: port publishing
- Docker docs: bridge network driver
- Docker docs: resource constraints (cgroups)
- docker build (CLI reference)
- docker run (CLI reference)
- docker rm (CLI reference)
- docker stop (CLI reference)
- docker ps (CLI reference)
- docker logs (CLI reference)
- docker exec (CLI reference)
- docker push (CLI reference)
- docker pull (CLI reference)
- docker tag (CLI reference)
- docker volume create (CLI reference)
- docker network create (CLI reference)