Docker Container

Anil Jalela · Published Sep 1, 2022 · 21 min read

Docker commands are easier to learn when the command, its options, and its result appear together. This concise workflow explains the commands you need to install Docker, run and inspect a container, build an image, use Compose, keep data in a named volume, troubleshoot failures, and add another node only when orchestration is required.

Start with the options table if a command such as docker run -it is unfamiliar. For example, -i means interactive mode, while -t gives the container a terminal. Then use the complete command table to understand what Docker will create, change, display, stop, or delete.

What Docker is and how its parts work

Docker was first released in March 2013 and is an open platform for building, shipping, and running applications. Docker Engine and the Moby project are largely Go-based, while the complete stack also includes components such as containerd, runc, Buildx, and Compose.

An image is not running. A container is what Docker creates and starts from that image. Removing a container does not automatically remove a named volume or the downloaded image.

Benefits and limits of containers

Containers make application packaging and process isolation repeatable, but they do not remove operating-system, storage, network, security, or orchestration work. Use them where the boundary is clear and test that boundary on the target platform.

Install Docker Engine

Use Docker's supported repository so Docker Engine, the command-line client, containerd, Buildx, and the Compose plugin come from one known source. Before installation, confirm that the host uses a supported 64-bit Ubuntu or RHEL release, inventory any existing containers and data, and remove conflicting distribution packages only after confirming they own no required workload.

Ubuntu

sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

. /etc/os-release
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${UBUNTU_CODENAME:-$VERSION_CODENAME} stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null

sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker

RHEL

sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo \
  https://download.docker.com/linux/rhel/docker-ce.repo
sudo dnf install docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker

Verify the client, server, build plugin, Compose plugin, and first test container:

sudo docker version
sudo docker info
sudo docker buildx version
sudo docker compose version
sudo docker run --rm hello-world

Commands below omit sudo for readability. A new user should prefix them with sudo unless an administrator has deliberately configured rootless Docker or approved Docker socket access. Membership in the docker group normally gives root-level control over the host, so do not add users to that group as a casual permissions fix.

Run your first container

Run these commands in order. After this table you will have downloaded an image, started a web container, tested it, entered it, viewed its logs, stopped it, and removed it.

Understand the command options first

The most important distinction is simple: -i keeps input open, -t creates a terminal, and -d puts the process in the background.

Essential Docker commands

Use this table as a task guide. Read the result and safety note before running a command that creates, publishes, or removes anything.

Attach, exec, expose, and publish

Complete current command coverage

The following commands complete the operational tasks covered by this guide. Commands marked Unsafe are still valid, so they are included, but they can interrupt workloads, remove data, expose the host, or create an image that cannot be reproduced. Read the scope and inspect the target before running them.

Manage the Docker service

Create images and containers with less common valid commands

List, inspect, authenticate, tag, and publish

Remove exact targets and perform unsafe bulk cleanup

Deprecated or invalid syntax is intentionally replaced at the point where its task is taught: use Docker's supported repository instead of an ambiguous distribution package, systemctl for service management, docker rm for container removal, current docker search filters, and OCI LABEL metadata in place of deprecated Dockerfile author syntax.

Dockerfile instructions, explained

The conventional filename is exactly Dockerfile, including the capital D on a case-sensitive filesystem. Dockerfile instruction names are conventionally written in uppercase so they are easy to distinguish from their arguments.

A small Dockerfile example you can build

Create an empty directory and enter it:

mkdir -p ~/docker-container-demo
cd ~/docker-container-demo

Add the following three files exactly as shown. The application returns one plain-text response so you can prove the image works without installing a framework.

server.py:

from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        body = b"Hello from the Docker example\n"
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

ThreadingHTTPServer(("0.0.0.0", 8080), Handler).serve_forever()

Dockerfile:

FROM python:3.13-slim
WORKDIR /app
COPY --chown=65532:65532 server.py /app/server.py
USER 65532:65532
EXPOSE 8080
CMD ["python", "/app/server.py"]

.dockerignore:

.git
__pycache__
*.pyc
.env

Build the image, start one container, test the response, read its logs, and stop it:

docker build --pull -t docker-demo:1.0.0 .
docker run --rm -d \
  --name docker-demo \
  -p 127.0.0.1:8080:8080 \
  docker-demo:1.0.0

curl http://127.0.0.1:8080/
docker logs docker-demo
docker stop docker-demo

The curl command should print Hello from the Docker example. When docker stop ends the process, --rm removes the stopped container automatically. The local image docker-demo:1.0.0 remains available for another run.

Know the basic Docker files and paths

Use a small Compose file

services:
  web:
    image: nginx:1.31.3-alpine
    ports:
      - "127.0.0.1:8080:80"
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run

docker compose config
docker compose up -d
docker compose ps
docker compose logs web
curl http://127.0.0.1:8080/
docker compose down

docker compose config checks and renders the file. up -d creates the project in the background. ps shows its containers. logs web shows the web service output. down removes the project's containers and network.

Create and use a named volume

docker volume create demo-data

docker run --rm -it \
  -v demo-data:/data \
  alpine:3.23 sh

docker volume inspect demo-data
docker volume ls

Inside the temporary Alpine shell, a file written under /data remains in demo-data after the container exits. The --rm option removes the container, not the named volume. Back up and restore application data before deleting the volume.

Add a node only when an orchestrator is required

Two standalone Docker hosts do not automatically share containers. Docker Swarm is one way to create a multi-node cluster. On the first manager:

docker swarm init --advertise-addr 10.20.0.10
docker swarm join-token worker

Run the returned command on the prepared worker:

docker swarm join \
  --token REPLACE_WITH_CURRENT_WORKER_TOKEN \
  10.20.0.10:2377

Then verify from a manager:

docker node ls
docker node inspect WORKER_NAME --pretty
docker swarm join-token --rotate worker

The token allows a node to join, so treat it as a secret. Production Swarm also needs manager quorum, firewall rules, address planning, service networks, secrets, persistent storage, monitoring, backup, upgrades, and node-removal procedures.

Quick troubleshooting

Do not begin troubleshooting with docker system prune --all --volumes. That is deletion, not diagnosis.

Official Docker references

• Docker Engine 29 release notes
• Install Docker Engine
• Docker command-line reference
• Dockerfile reference
• Compose file reference
• Docker volumes
• Add nodes to a Swarm

For help applying Docker to a real Linux environment, see DevOps Services and Linux Server Support.