Docker and Container Fundamentals Flashcards

Listed for reference and for searching. Use the deck above to study; recall works better than reading.

1. What is a container?

   A container is an isolated process running on the host kernel, packaged with its own filesystem, dependencies, and configuration. It is not a virtual machine; it shares the host kernel rather than booting its own.

2. What is the difference between an image and a container?

   An image is the read-only template (the packaged filesystem and metadata). A container is a running (or stopped) instance of an image, with a thin writable layer on top.

3. Which Linux kernel features make containers possible?

   Namespaces isolate what a process can see (PID, network, mount, user, etc.), and cgroups limit what it can use (CPU, memory, I/O). Together they give a process its own isolated view and resource budget.

4. How is a container different from a virtual machine?

   A VM runs a full guest OS on a hypervisor. A container shares the host kernel and isolates only the userspace, so it starts faster and uses far less memory and disk.

5. What is the container runtime Docker uses under the hood?

   Docker uses containerd, which in turn uses runc to actually create containers via the kernel. The docker CLI talks to the Docker daemon (dockerd).

6. How do you run a container from an image?

   Use docker run. Add -d to detach, -p to map ports, and --name to name it.

                             docker run -d -p 8080:80 --name web nginx
   
                           

7. How do you list running containers, and all containers?

   docker ps lists running containers; docker ps -a includes stopped ones.

8. How do you get a shell inside a running container?

   Use docker exec with -it to attach an interactive terminal.

                             docker exec -it web sh
   
                           

9. What does docker logs do?

   It shows the stdout/stderr of a container. Add -f to follow live output and --tail N to limit history.

10. How do you remove a container and an image?

    docker rm <container> removes a stopped container; docker rmi <image> removes an image. Use docker rm -f to force-remove a running container.

11. What is docker inspect used for?

    It prints detailed JSON metadata about a container, image, network, or volume: mounts, network settings, environment, and state.

12. What does the FROM instruction do?

    It sets the base image every subsequent instruction builds on. It is usually the first instruction in a Dockerfile.

13. What is the difference between RUN, CMD, and ENTRYPOINT?

    RUN executes a command at build time and commits the result as a layer. CMD sets the default command/args at run time (easily overridden). ENTRYPOINT sets the executable that always runs, with CMD supplying its default arguments.

                              ENTRYPOINT ["python", "app.py"]
    CMD ["--port", "8080"]
    
                            

14. What is the difference between COPY and ADD?

    COPY just copies local files into the image. ADD also unpacks local tar archives and can fetch URLs. Prefer COPY unless you specifically need ADD behavior.

15. What does EXPOSE do?

    It documents which port the container listens on. It does not publish the port; you still need -p or ports: to make it reachable from the host.

16. What is the purpose of WORKDIR?

    It sets the working directory for subsequent instructions (and the running container). It creates the directory if it does not exist, which is cleaner than chaining cd in RUN.

17. What is the difference between ARG and ENV?

    ARG defines a build-time variable available only during docker build. ENV sets an environment variable that persists into the running container.

18. What is a layer in a Docker image?

    Each instruction that changes the filesystem (FROM, RUN, COPY, ADD) creates a read-only layer. Layers stack to form the image and are cached and shared between images.

19. How does build-cache layer invalidation work?

    Docker reuses cached layers until an instruction (or its inputs) changes. Once one layer is invalidated, every layer after it rebuilds. Order instructions so the least-changing ones come first.

20. Why copy package manifests before source code in a Dockerfile?

    So dependency installation is cached separately from your code. Copying package.json and installing before copying the rest means code changes do not bust the dependency layer.

                              COPY package*.json ./
    RUN npm ci
    COPY . .
    
                            

21. What is a multi-stage build?

    A Dockerfile with multiple FROM stages where you build in one stage and copy only the artifacts into a small final stage. It keeps build tools out of the production image.

                              FROM golang:1.22 AS build
    WORKDIR /src
    COPY . .
    RUN go build -o app
    
    FROM alpine
    COPY --from=build /src/app /app
    ENTRYPOINT ["/app"]
    
                            

22. What is .dockerignore for?

    It excludes files from the build context sent to the daemon (like .git, node_modules, secrets). It speeds up builds and prevents accidentally copying large or sensitive files.

23. What does an image tag represent?

    A tag is a human-readable label pointing at a specific image version, like nginx:1.27. The latest tag is just a default name, not necessarily the newest build, so pin real versions in production.

24. Why do you need volumes if containers already have a filesystem?

    A container's writable layer is deleted when the container is removed. Volumes persist data independently of the container lifecycle.

25. What is the difference between a named volume and a bind mount?

    A named volume is managed by Docker in its own storage area and referenced by name. A bind mount maps a specific host path into the container. Bind mounts suit development; named volumes suit portable persistent data.

                              docker run -v mydata:/var/lib/data ...   # named volume
    docker run -v "$PWD":/app ...            # bind mount
    
                            

26. What is a tmpfs mount?

    A mount backed by host memory only. Data never touches disk and is gone when the container stops, which suits secrets and scratch data.

27. How do you list and remove volumes?

    docker volume ls lists them; docker volume rm <name> removes one; docker volume prune removes unused volumes.

28. What is the default Docker network driver?

    bridge. Containers on the default bridge get an internal IP and reach the outside through NAT.

29. What do the host and none network modes do?

    host removes network isolation so the container shares the host network stack directly. none gives the container no network at all except loopback.

30. How do containers on a user-defined bridge network find each other?

    Docker provides automatic DNS on user-defined networks, so containers resolve each other by container name. This does not work on the default bridge.

                              docker network create appnet
    docker run --network appnet --name db postgres
    docker run --network appnet --name api myapi   # reaches db by "db"
    
                            

31. What is an overlay network?

    A network that spans multiple Docker hosts, used in Swarm mode so containers on different machines communicate as if on one network.

32. What does port mapping -p 8080:80 mean?

    It publishes container port 80 on host port 8080. Traffic to the host on 8080 is forwarded into the container on 80.

33. What problem does Docker Compose solve?

    It defines and runs multi-container applications from a single YAML file, so you can start a whole stack (app, db, cache) with one command instead of many docker run invocations.

34. How do you start and stop a Compose stack?

    docker compose up -d starts it detached; docker compose down stops and removes the containers and networks. Add -v to down to also remove named volumes.

35. What does depends_on do, and what does it not do?

    It controls start order so one service starts after another. It does NOT wait for the dependency to be ready; use a health check with condition: service_healthy for that.

                              services:
      api:
        depends_on:
          db:
            condition: service_healthy
    
                            

36. How do you define a health check in Compose?

    With the healthcheck key: a test command, an interval, a timeout, and retries. The container is marked healthy once the test passes.

                              healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 10s
      timeout: 3s
      retries: 3
    
                            

37. What are Compose profiles used for?

    They let you tag services so they only start when their profile is enabled, keeping optional services (like debug tools or seeders) out of the default up.

38. What is a container registry?

    A service that stores and distributes images. Docker Hub is the default public one; Amazon ECR, GitHub Container Registry, and GitLab are common alternatives.

39. What is the workflow to publish an image to a registry?

    Tag the image with the registry path, log in, then push.

                              docker tag myapp:1.0 registry.example.com/team/myapp:1.0
    docker login registry.example.com
    docker push registry.example.com/team/myapp:1.0
    
                            

40. How do you authenticate Docker to Amazon ECR?

    Use the AWS CLI to get a login password and pipe it to docker login against your ECR registry URL.

                              aws ecr get-login-password --region us-east-1 \
      | docker login --username AWS --password-stdin \
        <account>.dkr.ecr.us-east-1.amazonaws.com
    
                            

41. What is the difference between docker pull and docker run for a missing image?

    docker pull only downloads the image. docker run downloads it if absent and then starts a container from it, so run implies a pull when needed.