Docker Services

A Docker image is a read-only template containing the application code, runtime, libraries, and dependencies needed to run an application. It is built from a Dockerfile and stored in a registry like Docker Hub. A container is a running instance of an image with its own writable layer, network interface, and process space. You can create multiple containers from the same image, each running independently. Think of the image as a class and the container as an instance of that class.

Use multi-stage builds to separate the build environment from the runtime, copying only necessary artifacts to the final image. Start with minimal base images like Alpine Linux or distroless images instead of full Ubuntu or Debian. Combine RUN commands to reduce layers and use .dockerignore to exclude unnecessary files from the build context. Order Dockerfile instructions from least to most frequently changed to maximize layer caching. Remove package manager caches and temporary files within the same RUN instruction.

Docker Compose is ideal for local development, testing, and small production deployments where simplicity is valued. It defines multi-container applications in a single YAML file and runs them with one command. Kubernetes is designed for production-scale orchestration with features like auto-scaling, rolling updates, self-healing, service mesh, and multi-node cluster management. Most teams use Docker Compose for development and Kubernetes for production, though Docker Compose can serve simple production workloads effectively.

Never bake secrets into Docker images or pass them as build arguments, as they persist in image layers. Use Docker secrets for Swarm mode or environment variables injected at runtime from a secrets manager like HashiCorp Vault, AWS Secrets Manager, or Kubernetes Secrets. For development, use Docker Compose with an env_file directive pointing to a .env file that is excluded from version control. Docker BuildKit supports secret mounts during build time that are not stored in the final image.

Docker containers share the host operating system kernel and isolate the application in user space, making them lightweight and fast to start (seconds vs. minutes). Virtual machines run a complete guest operating system on a hypervisor, providing stronger isolation but consuming more resources. Containers are typically 10-100x smaller than VMs and start almost instantly. VMs are better when you need to run different operating systems or require hardware-level isolation for security compliance. Many production environments use both together.

Use a multi-stage build with a builder stage for compilation and a minimal runtime stage. Start from a specific, pinned base image tag rather than latest. Run the application as a non-root user for security. Include a health check instruction for container monitoring. Copy dependency files and install dependencies before copying application code to optimize layer caching. Use COPY instead of ADD unless you specifically need URL downloading or tar extraction. Set appropriate labels for metadata and maintainability.