Docker

Theory

Docker packages applications and dependencies into images — immutable, layered filesystems built from Dockerfile instructions. Each RUN/COPY creates a cacheable layer; put slow-changing steps (dependency install) before frequently changing source copies to maximize build cache hits.

Containers are runnable instances of images, isolated via Linux namespaces (PID, network, mount, UTS) and constrained by cgroups for CPU and memory. Containers share the host kernel (unlike VMs), start in milliseconds, and use far less overhead per instance.

CMD sets default arguments to the container entrypoint; ENTRYPOINT defines the executable that always runs. Use exec form ["python","app.py"] so PID 1 receives signals directly — shell form runs under /bin/sh -c and can mishandle SIGTERM during shutdown.

COPY transfers files from build context into the image; ADD also fetches URLs and auto-extracts local tar archives — prefer COPY for predictable, auditable builds. A .dockerignore file excludes node_modules, .git, and secrets from the build context, speeding builds and preventing credential leaks.

Multi-stage builds chain multiple FROM stages: compile in a builder image, then COPY --from=builder only the binary or static assets into a minimal runtime (distroless, alpine). This routinely shrinks production images from hundreds of MB to under 30 MB.

Volumes persist data outside the container writable layer — named volumes survive container deletion and are managed by Docker. Bind mounts map host paths for dev hot-reload. Never store production database files only inside a container layer without a volume.

Docker networks: bridge (default, containers get private IPs), host (shares host network stack, no port mapping), none (isolated). On custom bridge networks, Docker's embedded DNS resolves service names to container IPs — essential for multi-container communication.

docker compose (Compose file v3) declares services, networks, volumes, and environment variables declaratively. docker compose up -d is the standard local-dev workflow; production clusters typically use Kubernetes, but Compose remains ideal for integration tests and small deployments.

Architecture Diagram

Dockerfile (build context)
         |
    docker build
         |
    Image (layers + manifest)
         |
    docker run --> Container(s)
         |
    Registry (ECR/GCR/DH)

Examples

# Build stage
FROM golang:1.22-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /api ./cmd/api

# Runtime stage
FROM gcr.io/distroless/static-debian12
COPY --from=builder /api /api
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/api"]

# Build and run
docker build -t myapp:1.0 .
docker run -d --name myapp -p 8080:8080 --restart unless-stopped myapp:1.0

# Inspect and debug
docker logs -f myapp
docker exec -it myapp sh
docker stats myapp

# Cleanup
docker system prune -f   # remove dangling images/containers

services:
  api:
    build: .
    ports: ["8000:8000"]
    environment:
      DATABASE_URL: postgres://user:pass@db:5432/app
    depends_on:
      db: { condition: service_healthy }
    networks: [backend]

  db:
    image: postgres:16-alpine
    volumes: [pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user"]
      interval: 5s
      retries: 5
    networks: [backend]

volumes:
  pgdata:

networks:
  backend:

Interview Questions

Best Practices

• Pin base image tags to digests or specific versions — latest breaks reproducible builds overnight.
• Use multi-stage builds: compile in a builder stage, copy only the binary into a slim runtime image.
• Run containers as non-root (USER app) — root in a container is still root if the kernel is escaped.
• Add a .dockerignore to exclude node_modules, .git, and build artifacts — shrinks context and speeds builds.
• Set explicit HEALTHCHECK or use orchestrator probes — a running container is not necessarily a healthy app.
• One process per container when possible — simplifies logs, signals, and horizontal scaling.

Common Mistakes

• Baking secrets into images with ENV API_KEY=... — layers are readable forever; use runtime secrets injection.
• Running docker run without --restart unless-stopped in production — containers stay down after host reboot.
• Using COPY . . before installing dependencies — any source change invalidates the dependency cache layer.
• Storing data only inside the container filesystem — data is lost on recreate; use named volumes or bind mounts.
• Ignoring image size — 2GB images slow deploys and increase attack surface; audit with docker history.

Cheat Sheet

Practical Exercises