Docker Containers

Understanding Docker containers in depth, covering container lifecycle, networking, volumes, resource management, and production best practices.

A Docker container is a running instance of a Docker image. Containers are lightweight, isolated processes that share the host operating system kernel but have their own filesystem, networking, and process space. Understanding container management is essential for cloud-native development.

Container Lifecycle

┌─────────────────────────────────────────────────────────────┐ │ CONTAINER LIFECYCLE │ │ │ │ Created ──► Running ──► Paused ──► Running │ │ │ │ │ │ │ │ ├──► Stopped ─────────►├──► Removed │ │ │ │ │ │ │ └────────────┴──────────────────────┘ │ │ │ │ docker create → docker start → docker pause/unpause │ │ docker run (create + start) │ │ docker stop → docker rm │ └─────────────────────────────────────────────────────────────┘

Container Management

bash example

# Run a container (foreground)
docker run -it ubuntu:22.04 bash

# Run a container (background/detached)
docker run -d --name web -p 8080:80 nginx

# Container lifecycle commands
docker start web
docker stop web
docker restart web
docker pause web
docker unpause web
docker rm web
docker rm -f web  # Force remove running container

# View container resource usage
docker stats
docker stats web --no-stream

# View processes inside container
docker top web

# Copy files to/from container
docker cp ./config.yml web:/etc/app/config.yml
docker cp web:/var/log/app.log ./app.log

# View container filesystem changes
docker diff web

Container Networking

bash example

# Default network types
docker network ls
# bridge (default) - containers on same bridge can communicate
# host - shares host network stack
# none - no networking

# Create custom network
docker network create --driver bridge app-network

# Run containers on custom network
docker run -d --name api --network app-network my-api
docker run -d --name db --network app-network postgres:15

# Containers on same network can reach each other by name
# api can connect to db using hostname "db"

# Expose ports
docker run -d -p 80:80 nginx          # Map host:container
docker run -d -p 127.0.0.1:80:80 nginx # Bind to localhost only
docker run -d -P nginx                  # Map to random host ports

┌─────────────────────────────────────────────────────┐ │ CONTAINER NETWORKING │ │ │ │ Host Machine (172.17.0.1) │ │ ┌───────────────────────────────────────────────┐ │ │ │ Docker Bridge Network │ │ │ │ (172.17.0.0/16) │ │ │ │ │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ │ │Container1│ │Container2│ │Container3│ │ │ │ │ │172.17.0.2│ │172.17.0.3│ │172.17.0.4│ │ │ │ │ │ :80 │ │ :5432 │ │ :6379 │ │ │ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ │ └───────────────────────────────────────────────┘ │ │ │ │ │ Port Mapping: Host:8080 → Container1:80 │ └─────────────────────────────────────────────────────┘

Container Volumes (Persistent Storage)

bash example

# Named volume (managed by Docker)
docker volume create app-data
docker run -d -v app-data:/var/lib/app my-app

# Bind mount (host directory)
docker run -d -v /host/path:/container/path my-app
docker run -d -v $(pwd)/data:/app/data my-app

# Read-only mount
docker run -d -v /config:/app/config:ro my-app

# tmpfs mount (in-memory, not persisted)
docker run -d --tmpfs /app/cache:rw,size=100m my-app

# List volumes
docker volume ls
docker volume inspect app-data
docker volume rm app-data
docker volume prune  # Remove unused volumes

Resource Limits

Example

# Limit memory docker run -d --memory=512m --memory-swap=1g my-app # Limit CPU docker run -d --cpus=2.0 my-app docker run -d --cpu-shares=512 my-app # Combined limits docker run -d \ --name production-app \ --memory=2g \ --memory-swap=4g \ --cpus=4.0 \ --restart=unless-stopped \ --health-cmd="curl -f http://localhost/health || exit 1" \ --health-interval=30s \ --health-timeout=10s \ --health-retries=3 \ -p 8080:8080 \ my-app:latest

Container Best Practices

Practice	Description
One process per container	Don't run multiple services in one container
Run as non-root	Use USER directive in Dockerfile
Use health checks	Enable automatic restart on failure
Set resource limits	Prevent containers from consuming all resources
Use read-only filesystem	Mount rootfs as read-only when possible
Log to stdout/stderr	Let Docker handle log collection
Use .env files	Don't hardcode secrets in images

Interview Questions

What is the difference between a Docker image and a container?

An image is a read-only template (like a class in OOP). A container is a running instance of an image (like an object). You can create multiple containers from one image, each with its own writable layer and isolated state.

How does container networking work in Docker?

Docker creates virtual bridge networks. Containers get IP addresses on the bridge and can communicate with each other. Port mapping (-p flag) exposes container ports to the host. Custom networks provide DNS-based service discovery between containers.

Explain Docker volumes and when you'd use them.

Volumes persist data beyond container lifecycle. Use named volumes for databases (data survives container restart), bind mounts for development (live code changes), and tmpfs for sensitive temporary data (never written to disk).

How do you limit container resources and why is it important?

Use --memory, --cpus, --pids-limit flags. Resource limits prevent a single container from consuming all host resources, ensure fair sharing in multi-tenant environments, and protect against memory leaks or runaway processes causing host crashes.

What happens when a Docker container stops?

The process inside terminates, but the container's writable layer persists on disk. You can restart it (docker start) to resume, or remove it (docker rm) to delete the writable layer. Data in volumes persists regardless; data only in the writable layer is lost on rm.

Container Lifecycle

Container Management

bash example

# Run a container (foreground)
docker run -it ubuntu:22.04 bash

# Run a container (background/detached)
docker run -d --name web -p 8080:80 nginx

# Container lifecycle commands
docker start web
docker stop web
docker restart web
docker pause web
docker unpause web
docker rm web
docker rm -f web  # Force remove running container

# View container resource usage
docker stats
docker stats web --no-stream

# View processes inside container
docker top web

# Copy files to/from container
docker cp ./config.yml web:/etc/app/config.yml
docker cp web:/var/log/app.log ./app.log

# View container filesystem changes
docker diff web

Container Networking

bash example

# Default network types
docker network ls
# bridge (default) - containers on same bridge can communicate
# host - shares host network stack
# none - no networking

# Create custom network
docker network create --driver bridge app-network

# Run containers on custom network
docker run -d --name api --network app-network my-api
docker run -d --name db --network app-network postgres:15

# Containers on same network can reach each other by name
# api can connect to db using hostname "db"

# Expose ports
docker run -d -p 80:80 nginx          # Map host:container
docker run -d -p 127.0.0.1:80:80 nginx # Bind to localhost only
docker run -d -P nginx                  # Map to random host ports

Container Volumes (Persistent Storage)

bash example

# Named volume (managed by Docker)
docker volume create app-data
docker run -d -v app-data:/var/lib/app my-app

# Bind mount (host directory)
docker run -d -v /host/path:/container/path my-app
docker run -d -v $(pwd)/data:/app/data my-app

# Read-only mount
docker run -d -v /config:/app/config:ro my-app

# tmpfs mount (in-memory, not persisted)
docker run -d --tmpfs /app/cache:rw,size=100m my-app

# List volumes
docker volume ls
docker volume inspect app-data
docker volume rm app-data
docker volume prune  # Remove unused volumes

Resource Limits

Example

Container Best Practices

Practice	Description
One process per container	Don't run multiple services in one container
Run as non-root	Use USER directive in Dockerfile
Use health checks	Enable automatic restart on failure
Set resource limits	Prevent containers from consuming all resources
Use read-only filesystem	Mount rootfs as read-only when possible
Log to stdout/stderr	Let Docker handle log collection
Use .env files	Don't hardcode secrets in images

Interview Questions

What is the difference between a Docker image and a container?

How does container networking work in Docker?

Explain Docker volumes and when you'd use them.

How do you limit container resources and why is it important?

What happens when a Docker container stops?

Docker Containers

Container Lifecycle

Container Management

Container Networking

Container Volumes (Persistent Storage)

Resource Limits

Container Best Practices

Interview Questions

Continue learning this concept

Docker Containers

Container Lifecycle

Container Management

Container Networking

Container Volumes (Persistent Storage)

Resource Limits

Container Best Practices

Interview Questions

Continue learning this concept