Docker is the container platform that standardized how applications are packaged, distributed, and run. A Docker container bundles an application with its runtime, libraries, and configuration into a lightweight unit that runs consistently across environments. Unlike virtual machines, containers share the host OS kernel, making them faster to start and more resource-efficient.
Key takeaways
- Docker packages applications with dependencies into portable containers.
- Containers share the host OS kernel, making them lighter and faster than VMs.
- Dockerfiles define reproducible build instructions. Images are the distributable unit.
- Docker Hub is the default public registry with official and community images.
- For production orchestration, combine Docker with Kubernetes.
Quick explanation
In simple terms
Docker is a tool that lets you package an application and everything it needs (code, libraries, settings) into a lightweight box called a container that runs the same way on any computer.
Technical definition
Docker is a container runtime and build platform that uses Linux namespaces and cgroups to create isolated user-space instances (containers) from layered read-only images defined by Dockerfiles, distributed via OCI-compliant registries.
Analogy
Docker is like a shipping container for software. Just as a shipping container holds goods in a standardized box that fits on any ship, truck, or train, a Docker container holds an application with everything it needs to run on any server.
Definition
Docker is a container platform that packages applications with their dependencies into portable, isolated containers. Containers share the host OS kernel, making them lighter and faster than virtual machines.
Docker is a container platform that packages applications and their dependencies into standardized units called containers. Per Docker's documentation, a container is a lightweight, standalone, executable package that includes everything needed to run an application: code, runtime, system tools, libraries, and settings.
Docker uses Linux kernel features (namespaces for isolation, cgroups for resource limits) to create containers that share the host OS kernel. This makes containers significantly lighter than virtual machines, which each run a full guest operating system. A Docker image is the blueprint; a container is a running instance of that image.
Why it matters
Core concepts
Docker Image
A read-only template containing the application code, runtime, libraries, and configuration needed to run a container.
Docker images are built in layers. Each instruction in a Dockerfile creates a layer. Layers are cached and shared between images, making builds faster and storage more efficient. Images are stored in registries (Docker Hub, GitHub Container Registry, Azure Container Registry).
Example
docker pull nginx:latest downloads the official Nginx image from Docker Hub.
Why it matters — Images are the unit of distribution. A single image can run identically on a developer laptop, a CI/CD pipeline, and a production Kubernetes cluster.
Container
A running instance of a Docker image with its own isolated filesystem, network, and process space.
Containers are isolated from the host and each other using Linux namespaces and cgroups. Each container has its own filesystem (layered on top of the image), network interface, and process tree. Containers are ephemeral by default: data is lost when the container stops unless volumes are used.
Example
docker run -d -p 8080:80 nginx starts an Nginx container mapping port 8080 on the host to port 80 in the container.
Why it matters — Containers provide application isolation without the overhead of virtual machines. They're the runtime unit that Docker manages.
Dockerfile
A text file containing instructions to build a Docker image layer by layer.
Each Dockerfile instruction (FROM, COPY, RUN, CMD, EXPOSE) creates a layer. Per Docker documentation, order matters for caching: put rarely changing layers first (base image, dependencies) and frequently changing layers last (application code).
Example
FROM python:3.12-slim, COPY requirements.txt ., RUN pip install -r requirements.txt, COPY . ., CMD ["python", "app.py"]
Why it matters — Dockerfiles make builds reproducible. Anyone with the Dockerfile and source code can build the exact same image.
How it works
Define the application in a Dockerfile
A developer writes a Dockerfile specifying the base image, dependencies, application code, and startup command. Each instruction creates a read-only layer.
Dockerfile → Build instructions
Build the image
docker build reads the Dockerfile and creates an image layer by layer. The final image is a stack of read-only layers that contains everything the application needs.
docker build → Image layers
Run a container from the image
docker run creates a container from the image. Docker adds a writable layer on top, sets up namespaces and cgroups for isolation, and starts the application process.
docker run → Container
Distribute via a container registry
docker push uploads the image to a registry (Docker Hub, ACR, ECR). Other environments pull the same image, ensuring consistency across development, staging, and production.
Push to registry → Pull anywhere
Benefits
Consistent environments across dev, staging, and production
Containers include everything the application needs. 'Works on my machine' becomes 'works everywhere' because the environment travels with the app.
Lighter than VMs
Containers share the host OS kernel instead of running a full OS. A server that runs 5 VMs can run 50+ containers.
Fast startup and teardown
Containers start in seconds versus minutes for VMs. Docker images can be pulled, started, and destroyed rapidly.
Limitations
Weaker isolation than VMs
MediumContainers share the host kernel. A kernel exploit in one container can affect all containers on the same host. VMs provide stronger isolation via hardware virtualization.
Workaround — Use container-optimized OS (Bottlerocket, Talos), run as non-root, enable seccomp/AppArmor profiles, and use gVisor or Kata Containers for stronger isolation.
Stateful applications need volumes
MediumContainer filesystems are ephemeral. Data is lost when a container stops unless explicitly stored in a Docker volume or bind mount.
Workaround — Use Docker volumes or bind mounts for databases and persistent data. In Kubernetes, use PersistentVolumeClaims.
Examples
Containerizing a web application
A developer packages a Node.js API into a Docker container for deployment to Kubernetes.
The developer writes a Dockerfile, builds an image locally with docker build, tests with docker run, then pushes to a container registry. The CI/CD pipeline pulls the image and deploys to Kubernetes.
Comparisons
Docker vs. VMs
Docker vs. Podman
Myths, corrected
Myth
Docker is the same as Kubernetes
Correction
Docker builds and runs individual containers. Kubernetes orchestrates multiple containers at scale. They're complementary: Docker creates the containers, Kubernetes manages them in production.
Why it happens: Both are associated with 'containers' and are often mentioned together, creating the impression they're alternatives.
Myth
Containers are always more secure than VMs
Correction
Containers share the host kernel, which means a kernel exploit affects all containers. VMs have stronger isolation via hardware virtualization. Per NIST SP 800-190, containers require additional security measures (image scanning, non-root execution, capability restrictions).
Why it happens: Containers are newer and associated with modern practices, creating an assumption that newer means more secure.
Practical implications
For admins
Manage Docker in production with Kubernetes (or Docker Swarm for simpler setups). Implement image scanning in CI/CD pipelines.
For security
Per NIST SP 800-190, scan images for CVEs, enforce non-root execution, use read-only filesystems, and limit container capabilities.
Related terms
Kubernetes
The standard container orchestration platform for managing Docker containers at scale.
Dockerfile
A text file containing build instructions for creating a Docker image.
OCI (Open Container Initiative)
A specification for container image formats and runtimes, maintained by the Linux Foundation.
Frequently asked questions
What is the difference between Docker and a VM?
Containers share the host OS kernel, making them lighter and faster. VMs run a full guest OS with a hypervisor, providing stronger isolation but higher overhead.
What is Docker Hub?
Docker Hub is the default public registry for Docker images. It hosts official images (nginx, postgres, python) and community images. Per Docker, Docker Hub serves over 14 billion image pulls per month.
How do I secure Docker containers?
Per NIST SP 800-190, key practices include: scan images for vulnerabilities, use minimal base images (Alpine, distroless), run as non-root user, use read-only filesystems, limit container capabilities, and don't run Docker daemon with root.
Does Docker replace Kubernetes?
No. Docker is for building and running individual containers. Kubernetes orchestrates multiple containers at scale: scheduling, scaling, networking, and self-healing. They're complementary, not competing.
What is Docker Compose?
Docker Compose defines multi-container applications in a single YAML file. It's used for local development environments where multiple services (web app, database, cache) need to run together.
Conclusion
Docker is the container platform that standardized application packaging. A Dockerfile defines the build instructions, docker build creates the image, and docker run starts a container. Containers share the host OS kernel, making them lighter and faster than VMs.
For production, combine Docker with Kubernetes for orchestration. Per NIST SP 800-190, scan images for vulnerabilities, run containers as non-root, and use read-only file systems where possible.
Main takeaway
