Docker images, containers, volumes and networks

Why and what

A container is an isolated process environment sharing the host kernel. An image is a layered filesystem/configuration template. Containers are not full virtual machines and are not a perfect security boundary. A container's writable layer disappears with that container unless data is stored externally or in a retained volume.

Build a static-site image

Install Docker using the official instructions for your OS. Docker-daemon access carries significant privilege. In a lab directory create index.html and Dockerfile:

FROM nginx:stable-alpine
COPY index.html /usr/share/nginx/html/index.html

docker build -t academy-web:1 .
docker run -d --name academy-web -p 127.0.0.1:8080:80 academy-web:1
curl http://127.0.0.1:8080/
docker logs academy-web
docker inspect academy-web
docker exec academy-web nginx -t

Host port 8080 maps to container port 80. Binding to 127.0.0.1 limits direct host exposure. To expose through a reverse proxy, proxy to that host loopback listener. Do not casually publish a database port to all interfaces.

Layers and build hygiene

Copy dependency manifests before frequently changing source to improve cache reuse. Use .dockerignore to exclude secrets and unrelated files. Build arguments are not secret storage; use supported build-secret mechanisms. Pin reviewed base-image digests for reproducible release builds and update them deliberately.

Volumes and networking

A named volume can persist when a container is removed. A bind mount exposes a specific host path and its permissions. A user-defined network enables service-name resolution between containers. localhost inside a container means that container, not the host or another database container.

Diagnose

docker ps -a
docker stats --no-stream
docker inspect --format '{{.State.ExitCode}}' academy-web

Exited containers can still have useful logs. An image built for the wrong CPU architecture may fail or require emulation. If a service listens only on its internal loopback interface, port publication will not make it reachable as intended.

Cleanup and assignment

Stop and remove only academy-web; remove its image when no longer needed. Avoid global prune commands on shared hosts. Change the heading, build a new version tag and explain why changing a local source file does not change a previously built image.

Official reference

Docker overview

Interview and revision check

Why does localhost fail for another container's database?

Each container has its own network context. Use the intended service name/network route rather than that container's loopback.