Docker has become one of the most important tools in software development, DevOps and cloud computing. It packages an application with its runtime, libraries and configuration so that it behaves consistently on a developer laptop, test server and cloud platform.
This beginner-friendly guide explains Docker architecture, images, containers, Dockerfiles, ports, volumes, networks, Compose, security and a practical classroom exercise.
What is Docker?
Docker is a platform for building, packaging, distributing and running applications inside lightweight isolated environments called containers. A container is a running instance of an image. The image contains the application and everything required to start it.
Remember it this way: Dockerfile = instructions; image = packaged blueprint; container = running application.
Why Docker matters
• Consistency: the same image runs across development, testing and production.
• Isolation: applications keep their own processes, files and dependencies.
• Speed: containers usually start in seconds because they share the host kernel.
• Portability: versioned images move between compatible machines and cloud services.
• Scalability: containerized services can be replicated and orchestrated.
• CI/CD: teams test and deploy the same immutable artifact.
Containers versus virtual machines
A virtual machine includes a complete guest operating system. A container shares the host operating-system kernel and packages mainly the application and dependencies. Containers are normally smaller and faster, while VMs provide machine-level isolation and can use a different kernel. Many production environments run containers inside cloud virtual machines.
Docker architecture
The Docker client accepts commands such as docker build and docker run. It sends API requests to the Docker daemon. The daemon builds images, creates containers and manages networks and volumes. A registry stores and distributes images; Docker Hub is a common public registry.
Typical flow: write a Dockerfile → build an image → optionally push the image to a registry → create one or more containers from the image.
Core components
Docker Engine is the core platform containing the daemon, APIs and command-line interface. A Dockerfile stores build instructions. An image is an immutable layered package. A container is an isolated running process. A registry stores images. Volumes preserve data independently of containers, while Docker networks connect services.
Install and verify
After installing Docker Desktop on Windows or macOS, or Docker Engine on Linux, run these commands in a terminal:
docker --version
docker info
docker run hello-world
The final command downloads a small test image, starts a container and prints a confirmation message.
Run your first web container
Start Nginx in the background:
docker run -d --name my-web -p 8080:80 nginx
-d means detached mode. --name assigns a readable name. -p 8080:80 maps host port 8080 to container port 80. nginx is the image. Open http://localhost:8080 in a browser.
Inspect it with docker ps and docker logs my-web. Stop it with docker stop my-web, start it again with docker start my-web, and remove it with docker rm -f my-web.
Container lifecycle
A container can be created, started, paused, unpaused, stopped, restarted and removed. Stopping does not delete it. Removing deletes its writable layer, but named volumes remain until separately removed. Use docker ps -a to display stopped containers and docker inspect <name> for full configuration.
Build an image with a Dockerfile
For a small Python Flask application, create app.py, requirements.txt and this Dockerfile:
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 5000
CMD ["python", "app.py"]
Build and run the image:
docker build -t my-flask-app:1.0 .
docker run -d --name flask-container -p 8080:5000 my-flask-app:1.0
The final dot in docker build is the current directory used as the build context.
Images and layers
Most Dockerfile instructions create reusable layers. Put stable dependency installation before frequently changing source code to benefit from build caching. Choose small trusted base images and use .dockerignore to exclude Git data, local environments, logs, build output and secrets.
Useful image commands include docker images, docker pull ubuntu:24.04, docker history <image>, docker rmi <image> and docker image prune.
Persistent data with volumes
A container's writable data may disappear when it is removed. Named volumes are suitable for databases and persistent application data.
docker volume create mysql-data
docker run -d --name mysql-db -e MYSQL_ROOT_PASSWORD=StrongPassword -v mysql-data:/var/lib/mysql mysql:8.0
Never hard-code real passwords in Dockerfiles or commit them to Git. Use environment files during development and approved secret-management tools in production.
Docker networking
A user-defined bridge network provides automatic DNS resolution using container names:
docker network create app-network
docker run -d --name database --network app-network mysql:8.0
docker run -d --name backend --network app-network my-backend:1.0
The backend can reach the database using the hostname database. Other network drivers include host, none, overlay and macvlan for different requirements.
Docker Compose
Docker Compose describes a multi-container application in one YAML file. A web service, database and cache can be configured together. Start with docker compose up -d, inspect with docker compose ps, follow logs using docker compose logs -f and remove containers and the application network with docker compose down.
Security and production best practices
• Use official or verified images and pin meaningful versions.
• Run applications as a non-root user when possible.
• Never bake passwords or API keys into images.
• Scan images and update vulnerable dependencies.
• Use multi-stage builds to reduce size and attack surface.
• Add health checks and resource limits.
• Write logs to standard output and keep one main concern per container.
• Avoid unnecessary exposed ports and never mount the Docker socket into untrusted containers.
Docker in DevOps and cloud
A CI/CD pipeline tests source code, builds a versioned image, scans it and pushes it to a registry. A deployment platform pulls that exact image. Kubernetes extends this model with scheduling, service discovery, scaling and self-healing across multiple machines.
Hands-on classroom activity
Ask students to containerize a static website. They create index.html, write an Nginx-based Dockerfile, build version 1.0, run it on port 8080, modify the page, rebuild version 2.0 and compare both image tags. This demonstrates repeatability, versioning, build context and port mapping.
Common troubleshooting
Port already in use: choose another host port, for example -p 8081:80.
Container exits immediately: check docker logs <name> and confirm that the main process remains active.
Build cannot find a file: check the build context, COPY paths and .dockerignore.
Application works inside but not in browser: verify port mapping and make sure the app listens on 0.0.0.0, not only 127.0.0.1.
Conclusion
Docker solves the classic “it works on my machine” problem by turning applications into repeatable, versioned packages. Master images, containers, ports, logs, volumes and networks first; then progress to Compose, CI/CD, registries and Kubernetes.
NeoAI Tech helps students and professionals develop practical skills in programming, cloud computing, DevOps, cybersecurity and artificial intelligence.
