Tech Definitions
What Is Docker?
"It works on my machine" is the problem Docker was built to solve.
What Is Docker?
Docker is a platform for packaging an application together with everything it needs to run -- code, runtime, system libraries, configuration -- into a single unit called a container. That container runs identically on a developer's laptop, a test server, and production, because it carries its own environment instead of depending on whatever happens to be installed on the host.
Containers vs. Virtual Machines
| Docker Container | Virtual Machine |
|---|---|
| Shares the host OS kernel | Runs its own full guest OS |
| Starts in seconds | Boots in minutes |
| Typically tens of MB | Typically several GB |
| Process-level isolation | Full hardware-level isolation |
Core Concepts
- Image -- a read-only template (your app + its dependencies) that a container is created from
- Container -- a running instance of an image
- Dockerfile -- a text file of instructions that builds an image
- Registry -- where images are stored and pulled from (e.g. Docker Hub)
Frequently Asked Questions
No. Docker builds and runs individual containers. Kubernetes orchestrates many containers across many machines -- scheduling, scaling, and restarting them. Most production systems use both: Docker (or a compatible runtime) to build/run containers, Kubernetes to manage them at scale.
Not required, but it's a genuinely useful habit -- it makes "how do I run this" trivial for anyone else (or future you), and matches how most real production systems are deployed today.
It provides process isolation, but not the same hard boundary as a VM. Running containers as a non-root user and keeping base images patched matters -- container isolation alone isn't a complete security model.