Docker

What is Docker and what does it do?

Docker is a platform for building, distributing and running container images. An image contains an application filesystem and its runtime dependencies. A container is a running process created from that image with its own configured view of networking, storage and other operating-system resources.

Containers share the host kernel. They are therefore lighter than full virtual machines, but they do not provide the same boundary as a guest operating system with separate virtual hardware. This distinction matters for security, compatibility and capacity planning.

From a Dockerfile to a running process

A Dockerfile describes how an image is assembled. Instructions form reusable layers, while a build produces an immutable image identified by content. A registry can distribute that artifact without rebuilding it on every host.

Runtime configuration stays separate from the image. Port publishing, environment values, volume mounts, resource limits and network membership are applied when a container starts. This separation allows one image to move through environments while the surrounding contract changes deliberately.

A small Compose contract

Compose describes related containers and their attachments in one YAML document. This example exposes an Nginx container on a local port and keeps its writable runtime paths temporary:

services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run

A production definition would also pin image provenance, define health behavior and keep secrets outside the document. A short configuration is a contract example, not a complete deployment policy.

State should outlive the right thing

The writable layer of a container is disposable. Data that must survive replacement belongs in a managed volume or an external service with its own backup policy. Logs should also leave the process through an explicit collection path rather than become hidden files inside a temporary container.

Networks create reachability, not trust. Services should expose only required ports, run with the least practical privilege and receive narrowly scoped credentials. Image scanning helps, but timely base-image updates and controlled registries remain necessary.

The lifecycle boundary

Docker fits applications that benefit from repeatable dependencies, isolated processes and a build artifact that moves consistently through delivery stages. It also makes disposable development environments easier to recreate.

The boundary is the infrastructure around the container. Host patching, image updates, registry trust, resource limits, storage, networking and secret rotation still need owners. A container makes the runtime contract visible; it does not automatically make that contract secure, durable or highly available.