Interactive architecture you can click into, 30+ Q&A, timed practice exam, hands-on labs, real company use cases, and a downloadable cheat sheet PDF.
Click any topic to expand. Each panel has explanations, code examples and visual diagrams. Designed for absolute freshers — read in order.
Docker uses a client-server architecture. You type commands using the Docker Client which talks to the Docker Daemon over a REST API. The daemon does the real work: building images, running containers, managing networks and volumes.
You type: docker run nginx ↓ Docker Client (CLI) ↓ REST API Docker Daemon (dockerd) ↓ containerd (high-level runtime) ↓ runc (low-level OCI runtime) ↓ Linux Kernel (namespaces + cgroups + overlayfs) ↓ 🚢 Container is running!
👉 Open the Architecture tab in the nav for the interactive version where you can click each component for deeper info.
A Docker image is a read-only template (like a class). A container is a running instance of that image (like an object). Images are built from stacked layers, where each Dockerfile instruction creates a new layer.
Image: my-app:1.0 ┌─────────────────────────────┐ │ Layer 4: CMD ["node","app"] │ ← writable when running ├─────────────────────────────┤ │ Layer 3: COPY . /app │ ← changes often (your code) ├─────────────────────────────┤ │ Layer 2: RUN npm install │ ← cached separately ├─────────────────────────────┤ │ Layer 1: FROM node:18 │ ← base image (rarely changes) └─────────────────────────────┘
name:tag. No tag → :latest. Avoid in production.A container is a running process isolated from the host using Linux namespaces and cgroups. Containers are ephemeral — when stopped, anything written inside is lost (unless you used a volume).
# Run a container detached, with port mapping docker run -d --name web -p 8080:80 nginx:1.25 # List containers docker ps # running only docker ps -a # all (including stopped) # Lifecycle docker stop web docker start web docker restart web # Get logs docker logs -f web # Exec into a running container docker exec -it web sh # Resource limits docker run -d --memory=512m --cpus=0.5 nginx # Cleanup docker rm web # stopped docker rm -f web # force (running)
A Dockerfile is a recipe — a text file with instructions Docker uses to build an image. Each instruction creates a layer.
# Base image FROM node:18-alpine # Working directory inside container WORKDIR /app # Copy dependency files first (better caching!) COPY package*.json ./ RUN npm ci --only=production # Copy source code COPY . . # Document which port the app uses EXPOSE 3000 # Run as non-root user (security) USER node # Default command when container starts CMD ["node", "server.js"]
Multi-stage build (much smaller images):
# Stage 1 — build (heavy) FROM node:18 AS builder WORKDIR /app COPY . . RUN npm install && npm run build # Stage 2 — runtime (lean) FROM node:18-alpine WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/node_modules ./node_modules USER node CMD ["node", "dist/index.js"]
Containers are ephemeral. To persist data (databases, uploads, logs), use volumes.
docker volume create mydata docker run -d -v mydata:/var/lib/mysql mysql:8 # named volume docker run -d -v $(pwd):/app node:18 # bind mount docker run --tmpfs /tmp nginx # tmpfs docker volume ls docker volume inspect mydata
Each container gets its own network namespace and IP. Docker provides drivers to control how containers communicate.
docker network create app-net docker run -d --name db --network app-net postgres:15 docker run -d --name api --network app-net my-api # inside api container, 'db' resolves to the db container docker network ls
Define a multi-container app in one YAML file. One command starts everything: web + db + cache + worker.
services:
web:
build: .
ports: ["8080:3000"]
environment:
DATABASE_URL: postgres://user:pass@db:5432/app
depends_on: [db]
networks: [app-net]
db:
image: postgres:15
environment:
POSTGRES_USER: user
POSTGRES_PASSWORD: pass
POSTGRES_DB: app
volumes: [db-data:/var/lib/postgresql/data]
networks: [app-net]
volumes:
db-data:
networks:
app-net:A registry stores Docker images. Docker Hub is the default. Companies use private registries (AWS ECR, GCP Artifact Registry, GitHub Container Registry).
docker pull nginx:1.25 # Tag for a registry docker tag my-app:1.0 myuser/my-app:1.0 docker tag my-app:1.0 myregistry.com/team/my-app:1.0 # Login & push docker login docker push myuser/my-app:1.0 # Pin by digest (immutable) docker pull nginx@sha256:abc123...
Tag strategy: Use semantic versions like 1.2.3. Avoid latest in production.
These practices save you from 90% of beginner pain — bloated images, slow builds, and security incidents.
alpine/distroless. node:18=1GB → node:18-alpine=180MB.USER node in Dockerfile.node_modules, .git, .env.docker scout or trivy.HEALTHCHECK so orchestrators know app is ready.💡 Click any component below to learn what it does, see how it connects, and read related Q&A. Everything is linked — visualize the flow and absorb knowledge fast.
30+ questions — Easy, Medium, Hard. Filter by difficulty. These cover everything you'll be asked when learning or applying Docker concepts.
FROM is the base, RUN is a cooking step, COPY adds your code, CMD is what's served when someone runs the container.docker pull <image> — download imagedocker build -t name:tag . — build from Dockerfiledocker run -d -p 8080:80 nginx — run containerdocker ps — list running (add -a for all)docker logs <name> — view logsdocker exec -it <name> sh — shell into containerdocker rm -f <name> — force removenginx, mysql, node), publish your own, share. Private alternatives: AWS ECR, GCP Artifact Registry, GitHub Container Registry.-p HOST:CONTAINER at runtime: docker run -p 8080:80 myimage.-d = detached mode. Container runs in background, terminal is freed. Without -d, container runs in foreground and Ctrl+C stops it. Use -d for servers, foreground for one-off tasks..gitignore for Docker. Lists files NOT sent to the daemon during build. Without it, Docker copies your entire project (including node_modules, .git, .env) — slow builds and leaked secrets. Typical entries: node_modules, .git, .env, *.log.docker run.ENTRYPOINT ["python","app.py"] + CMD ["--port=8080"]. The script always runs, flags are tweakable.COPY. Use ADD only when you actually want tar extraction.--build-arg. Disappears after build.-e on docker run.NODE_ENV=production.volume — managed by Docker. Best for prod.bind mount — links host folder to container. Best for dev.tmpfs — RAM only. For secrets/temp.docker run -d -v mydata:/var/lib/mysql mysqldocker run commands, write docker-compose.yml and run docker compose up. Handles networking, volumes, dependency order, env vars, scaling — declaratively.alpine, distroless, -slim.RUN commands in one line..dockerignore.package.json and npm install BEFORE copying source code, so code changes don't bust dependency cache.-e KEY=value — single var--env-file .env — from fileENV KEY=value in Dockerfile (default)docker-compose.yml via environment: or env_file:--env-file + .dockerignore on .env./var/lib/docker/volumes/. Best for production data, portable across hosts.-v /home/user/code:/app. Best for local dev — edit code on host, container sees changes.FROM in one Dockerfile. Each stage is independent. Final image only contains what you COPY --from=<stage>.golang:1.21 (~1GB) → copied into scratch (~10MB). Same app, 100x smaller.pid, net, mnt, uts, ipc, user.docker run → dockerd → containerd → runc → container.docker ps -a — see status, exit code.docker logs <name> — read the actual error.docker inspect <name> — full config, mounts, networks.docker run -it --entrypoint sh <image> — override entrypoint with shell.docker events — live stream of daemon events.USER appuser:latestdocker scout, trivy--cap-drop=ALL--read-only--memory, --cpusHEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/health || exit 1starting, healthy, unhealthy..env to git.--env-file at runtime/run/secrets/--secret for build-time.env in .gitignore AND .dockerignore.docker exec -it web sh. Exiting doesn't stop container.exec 99% of the time.-a) unused images. Does NOT touch volumes by default — your data is safe.docker system df first to see what's using space.15 multiple-choice questions, 15 minutes, instant scoring with explanations. Put your knowledge to the test.
15 MCQs. 15 minutes. Mix of easy, medium, and hard. You'll see explanations after each answer. Hit Start when you're ready.
—
Real terminal exercises. Each step has a copy-able command. Track your progress with checkboxes.
How real engineering teams use Docker every day. Each card is a scenario you'll see in production — and what container-based solution fixes it.
docker-compose.yml with the repo. New engineer runs docker compose up and has the full dev environment in 2 minutes — same versions as everyone else.docker run --rm from cron / Kubernetes CronJob. Runs, exits, vanishes — clean and isolated.docker compose up spins up the full test stack. Use testcontainers library to start fresh containers per test suite. Tests run identically on every machine.docker run my-research:1.0 reproduces results exactly.Every command you'll actually use, grouped by task. Click any command to copy. Hit "Download PDF" to take it offline.