Docker Images and Container Fundamentals

# Docker Images and Container Fundamentals

Introduction

Docker images and containers are the core building blocks of containerization. Images are read-only templates that contain application code, dependencies, and configuration. Containers are runnable instances of images. This tutorial covers image layers, Dockerfile best practices, building images, and container lifecycle management.

Learning Objectives

By the end of this tutorial, you will be able to:

• Understand Docker image layers and architecture
• Write efficient Dockerfiles
• Build, tag, and push Docker images
• Run and manage containers
• Understand container lifecycle
• Optimize image size and build time

Technical Background

Image Layer Architecture

Base Image (ubuntu:22.04)
    |
    +-- Layer 1: Install packages (apt-get install)
    |
    +-- Layer 2: Copy application code (COPY)
    |
    +-- Layer 3: Set environment variables (ENV)
    |
    +-- Layer 4: Set command (CMD)

Each layer is cached and immutable. Changes create new layers.

Container Lifecycle

Created --> Running --> Paused --> Stopped --> Deleted
     |           |         |          |
     v           v         v          v
  docker run  docker start  docker pause  docker rm
                docker stop

Prerequisites

• Docker installed and running
• Understanding of basic Linux commands

Hardware and Software Requirements

| Component | Requirement | |-----------|-------------| | Docker | v24+ | | Registry access | Docker Hub or private registry |

Step-by-Step Implementation

Phase 1: Dockerfile Fundamentals

#### Basic Dockerfile

# Use official base image
FROM ubuntu:22.04

# Install dependencies
RUN apt-get update && apt-get install -y \
    curl \
    wget \
    && rm -rf /var/lib/apt/lists/*

# Copy application code
COPY . /app
WORKDIR /app

# Set environment variable
ENV APP_PORT=8080

# Expose port
EXPOSE 8080

# Run application
CMD ["python", "app.py"]

Phase 2: Build Images

# Build image with tag
docker build -t myapp:1.0.0 .

# Build with multiple tags
docker build -t myapp:1.0.0 -t myapp:latest .

# Build from specific Dockerfile
docker build -f Dockerfile.prod -t myapp:prod .

# Build with build args
docker build --build-arg APP_VERSION=1.0 -t myapp:1.0 .

# View build history
docker history myapp:1.0.0

Phase 3: Run Containers

# Run container in foreground
docker run myapp:1.0.0

# Run container in detached mode
docker run -d myapp:1.0.0

# Run with port mapping
docker run -d -p 8080:8080 --name myapp myapp:1.0.0

# Run with environment variables
docker run -d -e DB_HOST=localhost -e DB_PORT=5432 --name myapp myapp:1.0.0

# Run with volume mount
docker run -d -v /host/data:/app/data --name myapp myapp:1.0.0

# Run with memory limit
docker run -d --memory="256m" --cpus="0.5" --name myapp myapp:1.0.0

Phase 4: Container Lifecycle Management

# List running containers
docker ps

# List all containers
docker ps -a

# Start stopped container
docker start myapp

# Stop running container
docker stop myapp

# Force stop container
docker kill myapp

# Restart container
docker restart myapp

# Pause container
docker pause myapp

# Unpause container
docker unpause myapp

# Remove container
docker rm myapp

# Remove running container (force)
docker rm -f myapp

# Execute command in running container
docker exec -it myapp /bin/bash

# View container logs
docker logs myapp

# Follow logs
docker logs -f myapp

# View container stats
docker stats myapp

Phase 5: Image Management

# List images
docker images

# Remove image
docker rmi myapp:1.0.0

# Remove unused images
docker image prune

# Remove all unused images
docker image prune -a

# Tag image
docker tag myapp:1.0.0 myregistry.com/myapp:1.0.0

# Push image to registry
docker push myregistry.com/myapp:1.0.0

# Pull image
docker pull myapp:1.0.0

# Inspect image
docker inspect myapp:1.0.0

Phase 6: Image Layer Optimization

#### Multi-Stage Build

# Build stage
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp main.go

# Final stage
FROM alpine:latest
WORKDIR /app
COPY --from=builder /app/myapp .
CMD ["./myapp"]

#### Layer Caching Best Practices

# Bad: Changes to source code invalidate all subsequent layers
COPY . /app
RUN npm install
RUN npm run build

# Good: Install dependencies before copying source
RUN npm install
COPY . /app
RUN npm run build

#### Combine RUN Commands

# Bad: Multiple layers
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y wget

# Good: Single layer
RUN apt-get update && apt-get install -y curl wget && rm -rf /var/lib/apt/lists/*

Expected Output

• Docker images built and tagged
• Containers running and manageable
• Image layers optimized
• Container lifecycle operations working

Verification Procedures

| Check | Command | Expected Result | |-------|---------|-----------------| | Image built | `docker images` | Image listed | | Container running | `docker ps` | Container in Running state | | Container logs | `docker logs <name>` | Application output visible | | Container exec | `docker exec <name> /bin/bash` | Shell access |

Troubleshooting Scenarios

| Issue | Diagnosis | Resolution | |-------|-----------|------------| | Build fails | Dockerfile error or missing file | Check Dockerfile syntax and context | | Container exits immediately | Application error or wrong CMD | Check logs; verify entrypoint | | Image too large | Too many layers or unnecessary files | Use multi-stage build; add .dockerignore | | Cannot connect to container | Port not published | Use -p flag when running |

Best Practices

• **Use .dockerignore:** Exclude unnecessary files from build context
• **Pin base image versions:** Use specific tags (e.g., `ubuntu:22.04`)
• **Combine RUN commands:** Reduce number of layers
• **Clean up in same layer:** Remove temporary files in same RUN command
• **Use multi-stage builds:** Reduce final image size
• **Run as non-root:** Use USER directive in Dockerfile
• **Add HEALTHCHECK:** Enable container health monitoring

Security Considerations

• **Scan images:** Use Docker Scout or Trivy for vulnerability scanning
• **Run as non-root:** Add USER directive to Dockerfile
• **Read-only root filesystem:** Use --read-only flag where possible
• **Drop capabilities:** Use --cap-drop=ALL and add only needed
• **Content trust:** Enable Docker Content Trust for image verification

Conclusion

Docker images and containers provide portable, reproducible application packaging. By understanding image layers, writing efficient Dockerfiles, and managing container lifecycles, you can build and deploy containerized applications effectively.

References

• Dockerfile Reference: https://docs.docker.com/engine/reference/builder/
• Docker Images: https://docs.docker.com/get-started/overview/
• Docker Containers: https://docs.docker.com/get-started/
• Docker Best Practices: https://docs.docker.com/develop/dev-best-practices/