Docker Container Basics Flashcards

Question 1

What is a Docker container, and what does it package together?

Accepted Answer

A Docker container is an isolated process that runs an application along with the libraries, tools, and settings it needs. Containers share the host operating system kernel rather than booting a full guest OS. Because the package carries its own dependencies, the same container runs consistently across laptops, test servers, and cloud hosts.

Question 2

How does a container differ from a virtual machine?

Accepted Answer

A container shares the host operating system kernel, while a virtual machine runs its own complete guest operating system on virtualized hardware. This makes containers smaller and faster to start, since there is no full OS to boot. Virtual machines offer stronger isolation because each has its own kernel.

Question 3

What is the difference between a Docker image and a container?

Accepted Answer

A Docker image is a template that holds the filesystem and startup instructions needed to create a container. A container is a running instance of an image, with its own writable layer on top. You can start many containers from one image, and deleting a container does not remove the image it came from.

Question 4

Why do developers use containers in their software workflow?

Accepted Answer

Developers use containers to make environments consistent, so code that works on one machine behaves the same on another. Containers also make it easier to isolate applications with conflicting dependencies, and they speed up onboarding because a new teammate can start the full stack with a few commands.

Question 5

What does it mean that a container is isolated?

Accepted Answer

Isolation means a container sees only its own processes, files, and network interfaces, not those of the host or other containers. On Linux, Docker builds this separation with namespaces, and it limits CPU and memory use with control groups. Isolation is useful but not a complete security boundary by itself.

Question 6

What role does a Docker registry play in sharing images?

Accepted Answer

A registry is a storage and distribution service that holds images, so teams and machines can upload and download them. Public registries are open to anyone, and organizations often run private registries for internal images. When you run an image that is not stored locally, Docker pulls it from a registry.

Question 7

What happens to data written inside a container when that container is removed?

Accepted Answer

Data written to a container's writable layer is lost when the container is removed, because that layer is deleted along with it. This temporary nature is why containers are often described as ephemeral. To keep data, store it in a volume or bind mount instead.

Question 8

What is the Docker daemon and what does it do?

Accepted Answer

The Docker daemon is a background service that builds images, starts and stops containers, and manages networks and volumes on a host. Client tools such as the docker command send requests to the daemon through an API. Because the daemon does the real work, it must be running before you can manage containers.

Question 9

How are Docker images built up from separate layers?

Accepted Answer

Each instruction in a Dockerfile creates a layer that stores only the changes it makes to the filesystem. Layers are stacked on top of one another to form the complete image. Because layers are cached and shared, images built from the same base can reuse them, which saves disk space and build time.

Question 10

What is a base image and why do many Dockerfiles begin with one?

Accepted Answer

A base image is the starting image that your image builds on, often containing a minimal operating system or a language runtime. Dockerfiles begin with a FROM instruction that names this base. Starting from a maintained base saves effort, because common system pieces are already installed and you only add what your application needs.

Question 11

What is an image tag, and why does it matter?

Accepted Answer

An image tag is a label, such as a version name, attached to an image to identify a specific build. If you omit a tag, Docker assumes the tag named latest. Tags matter because latest is not guaranteed to be the same image over time, so pinning a specific tag makes builds more predictable.

Question 12

How can you list the images stored on your local machine?

Accepted Answer

Run docker images, or the equivalent docker image ls command, to list the images stored on your local machine. The output shows each repository, its tag, the image identifier, how long ago it was created, and its size. Use this list to check which images are taking up space before removing any of them.

Question 13

Why does changing one instruction in a Dockerfile affect later layers?

Accepted Answer

When a layer changes, Docker must rebuild that layer and every layer after it, because each layer depends on the one beneath it. Layers that come before the change can be reused from the cache. This is why builders place rarely changing instructions, such as system package installs, near the top of the file.

Question 14

What does the docker image inspect command show you?

Accepted Answer

The docker image inspect command returns detailed metadata about an image in JSON format. This includes the layers that make up the image, its environment variables, its default command, and the exposed ports. Inspecting an image is a quick way to confirm what it contains before you run it.

Question 15

What is a multistage build and what problem does it solve?

Accepted Answer

A multistage build uses several FROM instructions in one Dockerfile, so earlier stages can compile or test code with large tools. Only the final stage becomes the image you ship. This solves the problem of build tools and source code bloating the final image, which makes images larger and expands the attack surface.

Question 16

Why should you avoid storing secrets inside an image layer?

Accepted Answer

Anything written into an image layer stays in the image history, so anyone with access to the image can recover it, even if a later layer deletes the file. Secrets such as passwords and API keys should be supplied at runtime through environment variables or a secrets mechanism instead.

Question 17

Which command starts a new container from an image?

Accepted Answer

The docker run command creates a new container from an image and starts it. If the image is not present locally, Docker pulls it from a registry first. You can add flags to control behavior, such as running in the background or assigning a name.

Question 18

What does the detached flag do when you run a container?

Accepted Answer

The -d flag runs a container in detached mode, so it operates in the background and returns control of your terminal immediately. Without it, the container's output appears in your terminal and your shell waits until it exits. Detached containers are common for web servers and other long-running services.

Question 19

How do you list containers that are currently running?

Accepted Answer

Run docker ps to list running containers, showing each container's ID, image, command, status, ports, and name. To include stopped containers as well, add the -a flag to the same command. This quick check helps you confirm that a service started as expected.

Question 20

How do you stop a running container without deleting it?

Accepted Answer

Run docker stop followed by the container name or ID. Docker sends a termination signal and waits a short time for the process to exit cleanly before forcing it to stop. The container remains on the system in a stopped state, so you can restart it later with docker start.

Question 21

What is the difference between stopping and removing a container?

Accepted Answer

Stopping a container halts its process but keeps the container and its writable layer on the system, so it can be started again. Removing a container, done with docker rm, deletes it entirely along with its writable layer. Removal does not delete the image the container was created from.

Question 22

How can you view the logs produced by a container?

Accepted Answer

Run docker logs followed by the container name or ID to print the output the container has written to its standard output and standard error streams. Adding the -f flag follows the output live as new lines arrive. Logs are useful for diagnosing why an application failed to start.

Question 23

How do you open a shell inside a running container?

Accepted Answer

Use docker exec with the -it flags, followed by the container name and the shell program, such as sh or bash. The -i flag keeps input open and the -t flag allocates a terminal. Exec starts a new process inside the container, so exiting the shell does not stop the container.

Question 24

What does the option that automatically removes a container on exit do?

Accepted Answer

The rm flag, written with two leading hyphens, tells Docker to automatically remove the container when its process exits. This keeps temporary containers, such as one-off test runs, from piling up on the system. The image is not affected, and you can still start a new container from it at any time.

Question 25

How do you publish a container port to the host machine?

Accepted Answer

Use the -p flag with the host port, a colon, and the container port, for example -p 8080:80. Traffic sent to the host port is forwarded to the port the application listens on inside the container. Published ports make a containerized web server reachable from your browser or other machines.

Question 26

Why does an application need to listen on all interfaces inside a container?

Accepted Answer

If an application binds only to the loopback address inside the container, traffic forwarded from the host cannot reach it. Binding to all interfaces, often written as 0.0.0.0, lets the process accept connections arriving on the container's network address. This is a common cause of confusion when a containerized service runs but appears unreachable.

Question 27

What is the default network driver Docker uses for containers?

Accepted Answer

The default network driver is bridge, which gives each container its own address on a private network managed by the host. Containers on the same user-created bridge network can reach each other by name. Other drivers include host, which shares the host's network stack, and none, which disables networking.

Question 28

How do containers on a user-defined network find each other?

Accepted Answer

Docker runs an embedded DNS service on user-defined networks, so containers can resolve one another by container name or network alias. Your application can then connect to a database using a simple hostname instead of a changing IP address. Containers on the default bridge network do not get this name resolution by default.

Question 29

What is the purpose of a named volume?

Accepted Answer

A named volume is storage managed by Docker that persists data independently of any single container's lifecycle. You refer to it by name when starting a container, and Docker stores its contents in a location it controls on the host. Volumes can be attached to a new container, which makes them useful for databases.

Question 30

How does a bind mount differ from a named volume?

Accepted Answer

A bind mount links a host directory into the container at a path you choose. A named volume is managed by Docker, and you do not need to know where its data lives on the host. Bind mounts suit development, where you want edits on your machine to appear inside the container immediately.

Question 31

What happens if two containers try to publish the same host port?

Accepted Answer

The second container cannot start, because the host port is already in use by the first container. Docker reports a conflict when you attempt the second run. To fix this, choose a different host port for one of the containers, while the container port can stay the same.

Question 32

Why do many teams run each container with a single main process?

Accepted Answer

A single main process makes the container's health easy to judge, because Docker tracks the status of the primary process to decide whether the container is still running. Logs and restarts stay simple to reason about. Running several unrelated services in one container complicates updates and failure handling, so separate containers are usually preferred.

Question 33

What does the FROM instruction do in a Dockerfile?

Accepted Answer

The FROM instruction sets the base image for the build, and it must appear before any instruction that changes the filesystem. Every Dockerfile needs at least one FROM line. Later instructions build on top of the base image's filesystem and settings.

Question 34

What is the difference between COPY and ADD in a Dockerfile?

Accepted Answer

COPY transfers files and directories from the build context into the image, and it is the clearer choice for most uses. ADD does the same job but can also extract local tar archives and fetch remote URLs. Because COPY is more explicit, most guidance recommends it unless you specifically need ADD's extra features.

Question 35

What does the RUN instruction do during an image build?

Accepted Answer

The RUN instruction executes a command inside a temporary container during the build, then saves the resulting filesystem changes as a new layer. Each RUN creates one new layer. Typical uses include installing packages or compiling code. RUN happens at build time, not when the container starts later.

Question 36

What does the CMD instruction define in a Dockerfile?

Accepted Answer

CMD sets the default command that runs when a container starts from the image. It can be overridden by supplying a different command on the docker run command line. Only the last CMD in a Dockerfile takes effect, so most images define exactly one.

Question 37

What is the purpose of the EXPOSE instruction?

Accepted Answer

EXPOSE documents which port the application listens on, serving as information for people and tools reading the Dockerfile. It does not publish the port to the host by itself. You still need the -p flag when running the container to make the port reachable from outside.

Question 38

What does a .dockerignore file do during an image build?

Accepted Answer

A .dockerignore file lists paths in the build context that Docker should exclude when sending files to the builder. Excluding items such as version control folders, local dependency caches, and secret files keeps the context small and builds faster. It also reduces the chance that sensitive files are copied into an image accidentally.

Question 39

How do you build an image from a Dockerfile in the current directory?

Accepted Answer

Run docker build with a tag flag, such as -t followed by a name, and end the command with a period to use the current directory as the build context. Docker reads the Dockerfile, executes each instruction in order, and produces a tagged image. Successful builds report the final image identifier.

Question 40

What is a practical first step for debugging a container that exits immediately?

Accepted Answer

Check the container's logs with docker logs, since the output usually explains why the main process stopped. Then inspect the exit code shown in docker ps -a or docker inspect to see whether the process failed or finished normally. Finally, confirm the command and environment variables match what the application expects.

Docker Container Basics Flashcards

1Core Container Concepts

2Images and Layers

3Container Lifecycle and Commands

4Networking and Storage

5Dockerfiles and Applied Practice

Learning Resources