Containers & Orchestration
Docker
Industry-standard container runtime and OCI image engine for reproducible environments.
Docker packages applications and their entire dependency tree into lightweight, isolated Linux namespaces. By decoupling software from underlying host operating systems, it eliminates 'works on my machine' bugs and forms the universal unit of deployment for microservices and cloud infrastructure.
Virtual Lab Ready
Automated testing sandbox running in your browser.
Launch First Lab ⚡No local installation required
Hands-on Practice
Interactive Terminal Labs
Real environment tasks with automated validation. Write real commands, verify state, and debug errors.
Deploy the Application as a Container
Topic: Containers & Images
A simple HTTP application image (app:latest) is already pulled on this machine. Deploy it as a container so it is reachable on port 8080. The walkthrough shows the exact commands and what every flag does.
Key Checks:
- A container built from app:latest is running
- Port 8080 is exposed and mapped
Build Your Own Image
Topic: Building Images
Instead of consuming images, make one. Write a Dockerfile, build it with a tag and run a container from your own image.
Key Checks:
- Directory ~/build exists with a Dockerfile
- Image myapp:1.0 exists locally
Capture Container Output
Topic: Logs & Inspection
Run the app, capture its logs into a file with shell redirection and verify the port it listens on. Reading container output is the first step of debugging any container.
Key Checks:
- A container from app:latest is running
- File ~/report/container.log exists containing the container's output
Clean Up Containers and Images
Topic: Cleanup & Lifecycle
Leftover containers and images eat disk on every real machine. Stop the running app, remove its container, then remove the image itself — and prove it's gone.
Key Checks:
- No container from app:latest is running
- Image app:latest has been removed locally
Untangle a Port Conflict
Topic: Port Conflicts
Staging needs its own copy of the app, but production already owns host port 8080 — and publishing a second container onto a busy host port fails with 'port is already allocated'. Prove who owns 8080, find a genuinely free port and give staging its own front door.
Key Checks:
- A container from app:latest is running
- Port 8080 stays mapped to the production container
Run the Container as a Non-Root User
Topic: Image Hardening
Containers are often root on the host's behalf, which turns any bug into a host bug. Build an image that creates an unprivileged user and switches to it before the app starts.
Key Checks:
- File ~/app/Dockerfile creates an unprivileged user
- The image runs as that user
Build a Multi-Stage Image
Topic: Image Hardening
Build tools do not belong in a runtime image. Use two stages - one to compile, one to ship - so the final image only carries what the application needs to run.
Key Checks:
- File ~/app/Dockerfile declares two build stages
- The runtime stage copies artifacts from the build stage
System Design
Docker Engine & Container Isolation
Understand how this tool operates internally before running production workloads.
Internal Mechanics
The Docker daemon (dockerd) communicates with containerd via gRPC to instruct runc to configure Linux kernel primitives (cgroups for resource limits, namespaces for PID/network/mount isolation, and overlay2 for copy-on-write filesystem layers).
Mental Model Rule of Thumb
Never treat Docker as a black box. Understanding its boundary with the kernel, filesystem, and network stack prevents 90% of production outages.
Core Architectural Subsystems
dockerd (Daemon)
REST API server handling container build, push, pull and lifecycle events.
containerd & runc
OCI-compliant low-level runtime that configures namespaces and cgroups.
OverlayFS2
Union filesystem layering read-only image layers under a thin writable container layer.
Bridge Network
Software bridge creating virtual ethernet pairs (veth) with iptables NAT.
Developer Reference
Command Reference & Cheatsheet
Curated commands, flags, and one-liners tested for everyday operational productivity.
docker run -d -p 8080:80 --name web nginx:alpineRun detached container mapping host 8080 to container 80
docker ps -a --format 'table {{.Names}} {{.Status}} {{.Ports}}'List all containers with custom formatted columns
docker build -t app:v1 --no-cache -f Dockerfile .Build image from local context without cached layers
docker logs -f --tail 100 <container-id>Follow container stdout/stderr output streaming
docker exec -it <container-id> shOpen an interactive TTY shell inside running container
docker system prune -af --volumesRemove all stopped containers, unused networks, images and volumes
Fundamental Primitives
Key Terminology & Primitives
Core abstractions you must master to communicate and build with confidence.
Image vs Container
An image is an immutable, multi-layered snapshot. A container is an active running process with an ephemeral writable layer.
Multi-stage Builds
Separating build toolchains (Go/Node/Rust compilers) from the final minimal production runner image (Alpine/Distroless).
Volumes & Bind Mounts
Bypassing the copy-on-write layer to persist state directly onto the host filesystem or managed storage drivers.
cgroups v2
Linux kernel mechanism limiting CPU quota, memory limits, and OOM killer behavior per container.
Production War-Stories
Common Pitfalls & Debugging Playbook
The exact errors that take down production systems and how to diagnose and resolve them.
Container exits immediately with code 0
Symptom
docker ps shows Exited (0) within 1 second of startup.
Resolution
The entrypoint PID 1 finished and exited. Ensure the main foreground process (e.g. nginx -g 'daemon off;' or node server.js) remains active.
Out of Memory (OOMKilled - 137)
Symptom
Exit code 137 with 'Killed' in dmesg.
Resolution
The container exceeded its cgroup memory limit. Increase memory limits in Compose/K8s or tune JVM/Node heap flags.
Reliability Standards
Production Readiness Checklist
Review this checklist before deploying workloads to staging or production clusters.
- ✓Never run containers as root — declare a non-root USER directive.
- ✓Use minimal base images such as distroless or alpine.
- ✓Order Dockerfile commands from least to most frequently modified to maximize layer caching.
- ✓Always set resource limits (--memory and --cpus).
- ✓Store ephemeral state outside containers via persistent volumes.
Full Curriculum Track
Master Docker as part of the DevOps Engineer path
Tools do not exist in isolation. Learn how Docker connects with other systems, CI/CD pipelines, and infrastructure patterns.