What is Docker?

Docker is an open platform for developing, packaging, shipping, and running applications in containers. A container includes an application and the files it needs, such as libraries, runtime components, and configuration defaults. This packaging helps the application behave consistently across development, testing, and deployment environments.

Docker provides tools for building container images, starting and managing containers, creating isolated networks, and storing persistent data. Developers commonly use Docker through Docker Desktop on Windows and macOS or Docker Engine on Linux. The official Docker documentation contains installation instructions and platform-specific requirements.

Docker images, containers, registries, and Dockerfiles

Four concepts form the foundation of a Docker workflow:

  • Docker image: A read-only package containing an application, its runtime, libraries, and filesystem content. Images are built in layers and can be reused to create multiple containers.
  • Docker container: A runnable instance of an image. A container receives its own writable layer, process space, network configuration, and resource settings.
  • Dockerfile: A text file containing instructions that Docker follows to build an image. It records the base image, files, dependencies, configuration, and startup command.
  • Container registry: A service used to store and distribute images. Docker Hub is Docker’s public registry, while organizations can also operate private registries.

An image is the packaged template; a container is a running or stopped instance created from that template. Deleting a container does not delete the image from which it was created.

How Docker runs an application

Docker normally follows a client-server architecture. The Docker client accepts commands, and the Docker daemon performs operations such as building images, downloading images, creating networks, and starting containers. The client and daemon communicate through the Docker API.

  1. A developer writes application code and a Dockerfile.
  2. docker build processes the Dockerfile and creates an image.
  3. The image can be stored locally or pushed to a registry.
  4. docker run creates and starts a container from the image.
  5. Ports, volumes, environment variables, and networks connect the container to the services and data it requires.

Linux containers share the host’s Linux kernel instead of carrying a complete guest operating system. Docker Desktop runs Linux containers inside a managed Linux virtual machine on Windows and macOS. Windows can also run Windows containers when the host and container configuration supports them.

Docker features that support application development

  • Portable application packages: An image records the application environment so that the same image can be tested and deployed on compatible Docker hosts.
  • Process isolation: Containers use operating-system features to separate processes, filesystems, networks, and resource allocation.
  • Layered images: Docker can reuse unchanged image layers, reducing repeated work during builds and transfers.
  • Declarative builds: A Dockerfile keeps image-building instructions with the application source and makes the environment easier to reproduce.
  • Container networking: Docker networks allow containers to communicate using assigned container or service names.
  • Persistent storage: Volumes retain application data independently of a container’s writable layer.
  • Multi-container definitions: Docker Compose describes related services, networks, and volumes in a YAML file.

Why Docker is used in development and deployment

Docker is useful when an application needs a repeatable runtime environment. Instead of asking every developer or server administrator to install identical dependency versions manually, a team can build and run the same image.

  • Local development: Run databases, message brokers, web servers, and application services without installing each service directly on the host.
  • Automated testing: Create a clean, repeatable environment for each test run and remove it afterward.
  • CI/CD pipelines: Build an image once, test that image, and promote the tested artifact through later deployment stages.
  • Service separation: Package different application components with their respective dependencies and configuration.
  • Temporary environments: Start disposable containers for experiments, demonstrations, troubleshooting, or integration tests.

Docker reduces environment differences, but it does not remove the need to test operating-system compatibility, CPU architecture, configuration, storage, networking, and external services.

Docker containers compared with virtual machines

ComparisonDocker containerVirtual machine
Operating systemShares a compatible host kernelRuns a complete guest operating system
Package contentsApplication and its user-space dependenciesApplication, dependencies, and guest OS
StartupUsually starts as an isolated processBoots a guest operating system
Typical usePackaging and isolating application servicesRunning separate operating systems or stronger machine-level boundaries
Resource footprintUsually smaller because containers share the kernelUsually larger because each VM includes a guest OS

Containers and virtual machines can be used together. For example, a cloud virtual machine may act as the Docker host for several containers. The correct choice depends on operating-system requirements, isolation needs, security controls, and infrastructure design.

Prerequisites for following this Docker tutorial

You do not need prior container experience. The following knowledge and tools will make the examples easier to follow:

  • Basic familiarity with a command-line shell and commands for navigating directories.
  • A supported Windows, macOS, or Linux system that meets the current Docker installation requirements.
  • Docker Desktop for a supported desktop platform or Docker Engine on a supported Linux distribution.
  • A text editor for creating Dockerfiles, Compose files, and application files.
  • A basic understanding of ports, environment variables, filesystems, and client-server applications.
  • Permission to enable the virtualization or operating-system features required by the selected Docker installation.

Kubernetes knowledge is not required for learning Docker fundamentals. Container orchestration is a separate topic that is usually studied after images, containers, networks, volumes, and registries.

Install Docker on Windows, macOS, or Linux

Use the official Docker installation instructions for your operating system. Platform requirements can change, so check the supported operating-system versions and prerequisites before installing.

  • Windows: Install Docker Desktop and complete any required virtualization or Windows Subsystem for Linux configuration described by Docker.
  • macOS: Download the Docker Desktop package that matches the Mac’s processor architecture and follow the installer prompts.
  • Linux: Install Docker Engine using the instructions for the specific Linux distribution. Configure non-root access only after reviewing the security implications of Docker group membership.

After installation, open a terminal and verify that the Docker client is available:

</>
Copy
docker --version
docker info

docker --version reports the client version. docker info also contacts the Docker daemon, so it helps confirm that the service or Docker Desktop is running.

Run the first Docker container with hello-world

The hello-world image provides a small installation test:

</>
Copy
docker run --rm hello-world

If the image is not stored locally, Docker downloads it from the configured registry. Docker then creates a container, runs its default command, displays the message, and removes the stopped container because the command includes --rm.

Next, run an Nginx web server in the background and publish it on local port 8080:

</>
Copy
docker run --name tutorial-web -d -p 8080:80 nginx

Open http://localhost:8080 in a browser. The port mapping sends traffic from port 8080 on the host to port 80 in the container. Inspect and remove the example with these commands:

</>
Copy
docker ps
docker logs tutorial-web
docker stop tutorial-web
docker rm tutorial-web

Build a Docker image from a Dockerfile

The following small example serves a static HTML file from Nginx. Create a new directory and add an index.html file:

</>
Copy
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Docker Example</title>
</head>
<body>
  <h1>Application running in Docker</h1>
</body>
</html>

Create a file named Dockerfile in the same directory:

</>
Copy
FROM nginx:alpine
COPY index.html /usr/share/nginx/html/index.html

Build the image, assign it the tag docker-static-site:1.0, and start a container:

</>
Copy
docker build -t docker-static-site:1.0 .
docker run --name static-site --rm -d -p 8080:80 docker-static-site:1.0

The final dot in the build command selects the current directory as the build context. Docker can access files within that context while processing COPY and related instructions. Add a .dockerignore file in real projects to exclude source-control metadata, local dependencies, credentials, build output, and other files that the image does not require.

Stop the example container when finished:

</>
Copy
docker stop static-site

Docker commands for inspecting images and containers

Docker commandPurpose
docker pull IMAGEDownload an image from a registry
docker image lsList locally available images
docker build -t NAME:TAG .Build and tag an image from the current directory
docker run IMAGECreate and start a container from an image
docker psList running containers
docker ps -aList running and stopped containers
docker logs CONTAINERRead a container’s standard output and error logs
docker exec -it CONTAINER COMMANDRun a command in a running container
docker stop CONTAINERRequest a running container to stop
docker rm CONTAINERRemove a stopped container
docker image rm IMAGERemove a local image that is no longer in use

Most commands accept either a container name or container ID. Run docker COMMAND --help to view supported options for a particular command.

Persist container data with Docker volumes

A container’s writable layer is tied to that container. Removing the container removes that layer, so databases and other stateful applications should store durable data outside it. Docker volumes provide storage managed by Docker and can be attached to replacement containers.

</>
Copy
docker volume create tutorial-data
docker volume ls
docker run --rm -v tutorial-data:/data alpine sh -c 'echo Docker > /data/example.txt'
docker run --rm -v tutorial-data:/data alpine cat /data/example.txt

The second container can read the file because both containers mount the same named volume. A bind mount is another storage option; it maps a specific host path into a container and is often used while developing source code locally.

Connect Docker containers through a user-defined network

A user-defined bridge network lets containers communicate using container names. Create a network and connect two example containers as follows:

</>
Copy
docker network create tutorial-network
docker run -d --name web-server --network tutorial-network nginx
docker run --rm --network tutorial-network curlimages/curl http://web-server

The client container resolves web-server through Docker’s network-level name resolution. Publishing a port with -p is necessary when a service must be reached from the host or an external network; it is not required merely for containers communicating on the same Docker network.

</>
Copy
docker rm -f web-server
docker network rm tutorial-network

Define multiple containers with Docker Compose

Docker Compose uses a YAML file to define related services and their networks, ports, volumes, and environment settings. The following compose.yaml file starts a web server:

</>
Copy
services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"

Run the project in the background, inspect its containers, and stop it:

</>
Copy
docker compose up -d
docker compose ps
docker compose logs
docker compose down

Compose is particularly useful for local applications that need several components, such as a web service, database, cache, and background worker. Store secrets outside the Compose file and avoid committing credentials to source control.

Docker image and container security practices

  • Use trusted base images and review their source, ownership, and maintenance status.
  • Use specific image versions or digests when a reproducible deployment is required. A mutable tag can point to different image content later.
  • Keep base images and application dependencies updated, then rebuild and retest images.
  • Run the application as a non-root user when the application permits it.
  • Do not place passwords, private keys, tokens, or production configuration inside an image.
  • Grant only the required volume mounts, Linux capabilities, devices, and network access.
  • Avoid exposing the Docker daemon socket to a container unless the security consequences have been evaluated.
  • Scan images and review software inventory and vulnerability findings as part of the delivery process.

Containers provide isolation, but they should not automatically be treated as equivalent to separate physical machines or virtual machines. Host security, daemon permissions, image provenance, runtime restrictions, and application security remain necessary.

Troubleshooting common Docker setup problems

Docker cannot connect to the daemon

Confirm that Docker Desktop or the Docker Engine service is running. On Linux, also verify that the current user has permission to access the Docker socket. Do not weaken socket permissions as a shortcut; follow the official post-installation guidance for the distribution.

Docker reports that a host port is already allocated

Another process or container is already using the selected host port. Inspect running containers with docker ps, stop the conflicting service, or map the container to a different host port, such as -p 8081:80.

A Docker container exits immediately

A container normally remains running only while its main process is running. Use docker ps -a to find the stopped container, then inspect docker logs CONTAINER and docker inspect CONTAINER for its command, exit code, mounts, and configuration.

Changes are missing after rebuilding a Docker image

Check that the correct directory is being used as the build context, the required files are not excluded by .dockerignore, and the container is being recreated from the intended image tag. When investigating cached build steps, rebuild with the appropriate cache settings rather than assuming the running container contains the latest image.

Docker learning path after the first container

  1. Practise starting, listing, inspecting, stopping, and removing containers.
  2. Build an application image from a Dockerfile and add an effective .dockerignore file.
  3. Learn how tags, digests, registries, image pulls, and image pushes work.
  4. Use named volumes for persistent data and bind mounts for suitable development workflows.
  5. Connect services with user-defined networks and publish only the ports that need host access.
  6. Define a multi-service development environment with Docker Compose.
  7. Study multi-stage builds, health checks, resource limits, logging, image scanning, and secrets management.
  8. Move to an orchestration platform only when the application requires deployment and management across multiple hosts or more advanced scheduling.

Docker frequently asked questions

What is Docker and why is it used?

Docker is a platform for building images and running applications in containers. It is used to package an application with its dependencies, reproduce runtime environments, isolate services, and move the same tested image through development and deployment workflows.

What is the difference between a Docker image and a container?

A Docker image is an immutable package used as a template. A container is a runnable instance created from that image and has runtime configuration plus a writable container layer. Multiple containers can be created from one image.

Is Docker the same as a virtual machine?

No. A virtual machine includes a complete guest operating system, while a container normally shares a compatible host kernel. Containers and virtual machines solve different isolation and deployment problems and are often used together.

Does Docker work on Windows and macOS?

Yes. Docker Desktop supports eligible Windows and macOS systems and runs Linux containers through a managed Linux virtual machine. Supported versions, processor requirements, and required operating-system features should be checked in the current Docker installation documentation.

Does deleting a Docker container delete its data?

Deleting a container removes its writable container layer. Data stored in a named volume or an appropriate bind-mounted host directory remains outside that layer and can be attached to another container. Applications should not rely on the container layer for data that must survive container replacement.

Docker tutorial editorial QA checklist

  • Confirm that installation guidance points readers to current Docker documentation instead of fixed operating-system requirements that may become outdated.
  • Verify that every Docker command distinguishes the image name, container name, host port, and container port correctly.
  • Check that command-line examples use docker compose for the current Compose CLI form.
  • Ensure that persistent application data is assigned to a named volume or an intentional bind mount rather than the container’s writable layer.
  • Review Dockerfiles and Compose examples to confirm that they contain no credentials, private keys, tokens, or production secrets.
  • Test the hello-world, Nginx, Dockerfile, volume, network, and Compose examples on a clean supported Docker installation.