HowToCodePage

Images and containers

What an image really is, how a container differs from a virtual machine, and the commands you will run every day.

Images are stacked layers

An image is an ordered set of read-only layers plus a small config that says which command to run. docker pull downloads only the layers you do not already have and reuses the rest from the local cache.

docker pull nginx:1.27-alpine      # a tag points at a specific digest
docker images                      # what is on disk
docker history nginx:1.27-alpine   # layer by layer
docker rmi nginx:1.27-alpine       # remove (fails if a container still uses it)
  • A tag such as 1.27-alpine can be moved to a different digest; a digest (@sha256:...) cannot.
  • Layers are shared between images, so ten images built FROM node:20-alpine store the base once.
  • latest is just a default tag, not a promise of the newest build. Pin a real version in production.
💡
A container is not a small virtual machine. It is an ordinary Linux process (or a few) isolated with namespaces and cgroups, running on top of an image plus one thin writable layer.

Running containers

docker run --rm -d --name web -p 8080:80 nginx:1.27-alpine
#            |    |         |         |         |
#            |    |         |         |         +-- image
#            |    |         |         +--- host port : container port
#            |    |         +----- a name you can use in later commands
#            |    +------- detach, run in the background
#            +------- delete the container when it stops

docker ps                 # running containers
docker ps -a              # including stopped ones
docker logs -f web        # follow stdout / stderr of PID 1
docker exec -it web sh    # a second process inside the same container
docker stats web          # live CPU, memory and network
CommandWhat it does
docker runCreate and start a container from an image
docker startRestart a stopped container with its original settings
docker execRun an extra command inside a running container
docker logsRead whatever PID 1 wrote to stdout and stderr
docker cpCopy files in or out without a mount
docker inspectFull JSON state: mounts, IP, environment, exit code

Lifecycle and cleanup

docker stop web          # SIGTERM, then SIGKILL after 10 seconds
docker kill web          # SIGKILL immediately
docker restart web
docker rm web            # only when stopped; -f forces it

docker system df         # where the disk went
docker system prune -a   # reclaim space: unused images, networks, build cache
  • The container stops when PID 1 exits, so the application must stay in the foreground: no daemonising, no systemd inside.
  • Exit codes tell the story: 137 is usually out-of-memory or SIGKILL, 143 is a clean SIGTERM, 1 is your own failure.
  • docker stop gives the process ten seconds to flush and close. Handle SIGTERM in the application or you lose in-flight work.

FAQ

Why does my container exit immediately?
Its main process finished or crashed. Check docker logs <name>: a command like bash with no TTY, or a config error, exits at once. Keep a long-running process as PID 1.
Does data written inside a container survive?
No. The writable layer is deleted with the container. Mount a volume or a bind mount for anything you need to keep.

Writing a Dockerfile Compose, volumes and networking

Last refreshed 2026-09-18.