Docker runs programs in isolated containers started from images and manages their ports, volumes and networks.
sudo systemctl enable --now docker
enable the service
sudo docker run -d --name web -p 8080:80 nginx:alpine
background
sudo docker ps -a
all containers and status
sudo docker logs --tail 20 web
main process output
sudo docker exec -it web sh
a shell inside
sudo docker stop web; sudo docker start web
sudo docker rm -f web
remove, even if running
sudo docker port web
published ports
sudo docker inspect -f '{{.State.Status}}' web
one field
sudo docker volume ls
volumes
sudo docker network ls
networks
sudo docker stats --no-stream
container CPU and memory
Docker runs programs in containers. A container is an ordinary Linux process that the kernel has given its own namespaces and cgroup (cgroups-namespaces): its own process tree, network and file system. The container takes its files and start command from an image.
How it works: the docker service (the dockerd daemon) creates and
keeps containers, and the docker command sends it requests through the
/var/run/docker.sock socket. Root and the docker group can write to
that socket.
On the lab machine student is not in the docker group, so every command
goes through sudo. Without it:
The service is disabled in the machine image: lesson or lab preparation
turns it on, by hand it is sudo systemctl enable --now docker.
The image is the template, the container is a named instance started from
it. One image can back many containers, each with its own writable layer.
docker images lists images, docker ps running containers, and
docker ps -a all of them, stopped ones included. The full ps -a table
is wide (ID, image, command, created, status, ports, name); --format
picks the columns you need:
docker run is docker create plus docker start. -d leaves the
container in the background, --name names it (at least two characters:
for a Docker answers Invalid container name), --rm removes the
container when it exits. Without --name Docker makes up a name.
A container lives as long as its main process — the
one started by the image command or by docker run. Inside the container
it has PID 1. When it exits, the container stops and the status shows its
exit code.
STATUS in docker ps -a |
What is going on |
|---|---|
Up 9 seconds |
the main process is running |
Up 6 seconds (healthy) |
running, the healthcheck passes |
Exited (3) 6 seconds ago |
the process exited with code 3 |
Exited (137) |
the process was killed by SIGKILL (137 = 128 + 9) |
Restarting (1) 1 second ago |
exited with 1, Docker starts it again |
Created |
created but never started, or the start failed |
docker logs tells why the process exited — everything the main process
wrote to stdout and stderr, including right before the crash:
docker logs -f follows live, -t adds timestamps, --since 10m shows
the last 10 minutes. Logs are kept as long as the container exists.
A container listens on a port at its own address in Docker's internal
network. The host addresses, localhost included, do not have that port
until you publish it. Port publishing
-p 8080:80 forwards host port 8080 to container port 80 — host first,
container second:
0.0.0.0 means the port is open on every host address. For this machine
only, use -p 127.0.0.1:8081:80. One host port can belong to one
container or service: a second -p 8081:… gets port is already
allocated.
-e NAME=value passes a variable to the
main process, --env-file app.env passes every NAME=value line of a
file. -e in the same command wins over the file:
Environment, ports and volumes are set when the container is created. A
running container cannot change them: remove it and create it again with
the new options. To see what it was created with:
docker inspect -f '{{json .Config.Env}}' web.
A restart policy tells Docker whether to start
the container again when its main process exits or when the docker
service itself restarts. Set it with --restart at creation; for an
existing container use docker update --restart unless-stopped web.
--restart |
The main process exits by itself |
|---|---|
no (default) |
the container stays Exited |
on-failure |
starts it again if the code is not 0; on-failure:3 — at most 3 times |
always |
starts it again whatever the code |
unless-stopped |
starts it again whatever the code |
always and unless-stopped differ on a manual stop. After
docker stop the container stays down under any policy. A restart of the
docker service brings back always containers, and unless-stopped
ones only if nobody stopped them by hand. A no container that was
running during the restart stays Exited (137). This is how it looks on
the machine:
With the docker service enabled (systemctl enable docker), containers
come back after a reboot by the same rules. docker stop holds an
always or unless-stopped container until the service restarts;
docker rm is forever.
A crashing container with always ends up in a restart loop: status
Restarting, RestartCount grows, and the pause between attempts roughly
doubles each time. Look for the cause in docker logs.
Whatever a container writes to its files lives in its
layer and goes away with docker rm.
Data that must survive re-creating the container is kept outside:
-v data:/var/lib/app. If the volume does not exist, docker run
creates it;-v /srv/web:/www.
A left side starting with / means a host directory.| What | Volume | Bind mount |
|---|---|---|
| Where the files are | /var/lib/docker/volumes/<name>/_data |
wherever you say |
| Empty on first mount | gets the image's files from that path | hides them, the container sees nothing |
| Owner and mode | as in the image | as on the host, numeric |
| Removal | docker volume rm |
by hand, like any directory |
Read-only is :ro at the end: -v /srv/web:/www:ro; a write inside ends
with Read-only file system. In a bind mount the container sees host
owners as numbers: a student file is 1000 1000. A process in the
container running as another user hits permissions exactly as on the
host.
docker volume rm will not remove a volume while any container uses it,
even a stopped one.
An anonymous volume appears when a path has no volume name: -v /data
or a VOLUME /data instruction in the image's dockerfile. Every
docker run without -v creates a new empty volume with a hash for a
name, and the previous container's data is not in it:
The first volume belongs to the removed va: docker rm left it, and
the data sits in /var/lib/docker/volumes/77a8…/_data. Mount it again by
that name: -v 77a8347b…:/data. docker rm -v and docker run --rm
remove anonymous volumes together with the container.
Every container has its own network interface — one end of a veth pair, the other end plugged into a bridge on the host. Docker creates three networks:
Without --network a container lands in bridge (the docker0 bridge,
172.17.0.0/16). There containers see each other by address only — no
names:
On the default network the container's /etc/resolv.conf lists the
host's DNS servers. The lab machine has only the local 127.0.0.53
there, which a container cannot reach, so Docker puts in 8.8.8.8 and
8.8.4.4.
On a user-defined network names work:
Docker DNS at 127.0.0.11 answers with the container
name.
docker network connect appnet web1 adds a running container to a second
network. Only the container the host talks to needs a published port
(-p); the rest talk inside the network. docker-compose creates such
a network for every project by itself.
Without limits a container may take all the memory and all the CPUs of
the machine. docker stats then shows the whole machine's memory in the
LIMIT column — 458.2MiB on the lab machine. The kernel enforces limits
through the container's cgroup (cgroups-namespaces):
| Option | What it limits |
|---|---|
--memory 64m |
memory of the container's processes |
--memory-swap |
memory and swap together; without it, twice --memory |
--cpus 0.5 |
half of one CPU |
inspect keeps the limits in bytes and billionths of a CPU:
Swap is off on the lab machine, so --memory is all the container gets.
A process that needs more is killed by the OOM killer:
the container exits with code 137, and inspect shows
OOMKilled: true.
Code 137 also follows a docker stop the process did not obey within 10
seconds — only OOMKilled tells them apart. Limits are an exception to
"set at creation": docker update --memory 32m --memory-swap 32m m1
changes them on a running container.
By default the main process runs as the container's root, UID 0. The
container and the host share one kernel, and UIDs too: in host ps such
a process is root. USER in the dockerfile or --user at run time
sets the user:
--user |
id inside the container |
|---|---|
1000 |
uid=1000 gid=0(root) groups=0(root) |
1000:1000 |
uid=1000 gid=1000 groups=1000 |
nobody |
uid=65534(nobody) gid=65534(nobody) … |
web |
error: unable to find user web: no matching entries in passwd file |
Docker looks names up in the image's /etc/passwd; any number works.
--user 1000 without a group leaves group 0 — root; give the group
explicitly: --user 1000:1000.
UID 1000 in the container is student on the host: in host ps a
sleep 600 started with --user 1000 belongs to student. Files the
process creates in a bind mount get its UID:
byroot was created by a root container — student on the host cannot
change it. A non-root process also hits permissions inside the image:
touch /etc/x gives Permission denied.
docker inspect prints everything about a container, image, volume or
network as JSON. -f with a Go template extracts one field: the dot is
the JSON root, then a path of keys.
| Field | What it holds |
|---|---|
.State.Status |
running, exited, restarting, created |
.State.ExitCode |
exit code of the main process |
.State.OOMKilled |
true — killed for going over the memory limit |
.State.Health.Status |
healthy, unhealthy, starting |
.RestartCount |
how many times Docker restarted the container |
.HostConfig.RestartPolicy.Name |
the restart policy |
.Mounts |
volumes and bind mounts: what, where, read-only or not |
.Config.Env |
environment variables |
.NetworkSettings.Networks |
networks and addresses |
range walks a map or a list. The container's address on every network:
For the whole JSON, jq is handier.
The service is configured in /etc/docker/daemon.json — JSON, no
comments:
Apply with sudo systemctl restart docker. A JSON error keeps the
service from starting: check journalctl -u docker. What took effect:
On the lab machine that is /var/lib/docker json-file. A service restart
stops every container. The restart policy decides which ones come back
(see the section above). Change data-root only to an empty directory:
the service does not move old images and volumes by itself.
Code 0 means the command simply finished: for a service it means it went
to the background. 137 means SIGKILL: out of memory (OOMKilled true) or
a docker stop the process did not answer. 1, 2 and others are errors of
the program itself, with the text in the logs.
Data in the volume survives re-creation; data in the container layer does not.
docker exec -it needs a terminal. In a script or a pipeline -t fails
with the input device is not a TTY — drop it:
docker exec web cat /etc/hosts.
The user is not in the docker group. Run with sudo. Group membership
gives root on the machine — see the Danger zone.
The service is not running: sudo systemctl enable --now docker. If you
stopped only docker.service, systemd warns its triggering units are
still active: docker.socket — the next docker command starts the
service again through the socket.
Bind for 0.0.0.0:8081 failed: port is already allocated — another
container or service holds the host port: sudo ss -tlnp | grep :8081
(ss). The container has already been created — remove it with
docker rm and start again with another port on the left.
A container with that name exists, maybe a stopped one (docker ps -a).
Remove the old one with docker rm or pick another name.
The main process finished without an error. A service that went to the
background does this: httpd without -f, nginx without daemon off.
The main process has to run in the foreground.
docker stop sends SIGTERM and waits 10 seconds. A PID 1 process without
its own SIGTERM handler never gets it — sleep and busybox httpd
behave this way — so Docker finishes it with SIGKILL: Exited (137). For
such containers use docker stop -t 1 or docker rm -f.
docker exec works only in a running container. Start a stopped one
with docker start; if it dies at once, read docker logs.
docker logs returns the container output on two streams: what the
process wrote to stderr goes to stderr. Program errors usually live
there, and a pipe does not see them. Merge the streams:
sudo docker logs web 2>&1 | grep error.
The data was in the container layer. Mount a volume: -v data:/path. An
old volume is still there if the container had one: docker volume ls.
Both are on the default bridge network: ping: bad address. Create
your own network and connect both (docker network connect).
A container needs the volume or network, maybe a stopped one. List them
with docker ps -a --filter volume=data1 or --filter network=appnet;
remove the containers, then the volume or network.
Whoever can write to docker.sock can start a container with
-v /:/host and get the whole host disk as root. Adding a user to the
docker group is the same as giving them passwordless sudo.
rm -f stops and removes a container at once, together with its layer.
Anything the container wrote outside a volume or bind mount is gone.
docker volume prune removes anonymous volumes no container needs; with
-a, named ones too. A volume whose container you are re-creating right
now is "needed by nobody" at that moment — its data is deleted for good.
Check docker volume ls before cleaning up.
docker load.docker service: enable, restart.docker.sock and its permissions.Found an inaccuracy? Report an error in the article