17.5 Docker

Q21. Image vs container?

Image is the read-only template; container is a running (or stopped) instance of that image.

Q22. What do FROM, COPY, RUN, CMD, EXPOSE do?

FROM base image; COPY files in; RUN build-time commands; CMD default start command; EXPOSE documents container port (publish still needs -p/orchestration).

Q23. Why avoid publishing DB ports to the world?

Attack surface. Publish only needed ports; keep DB on private networks/compose networks.

Q24. Bind mount vs named volume?

Bind mount maps a host path; named volume is Docker-managed. Anonymous volumes are easy to lose track of — name volumes you care about.

Q25. What is Docker Compose for?

Declare multi-container apps (api + db) with networks/volumes; up/down/logs for local and simple hosts.

Q26. How do you see why a container exited?

docker ps -a, docker logs, docker inspect exit code — fix CMD/env/config.