Container foundations
What a container is
Build a useful mental model of images, containers, isolation, and the host kernel before running Docker commands.
8 minute lesson
A container is an isolated process with its own view of files, environment variables, users, and networking. It is not a small virtual machine.
The image supplies the filesystem and startup instructions. Docker creates a writable container from that image and asks the host operating system to isolate the process. Containers start quickly because they share the host kernel instead of booting another operating system.
The startup command becomes the container’s main process. When that process exits, the container stops, even if files remain in its writable layer. A container is not a background machine that keeps running independently of its application.
Isolation is useful, but it is not a security boundary you can ignore. The process still shares a kernel with the host. Run with the fewest privileges you can, keep durable data outside the writable layer, and treat the image as the repeatable input from which disposable containers are created.
Write down the application, runtime, system packages, and startup command for a small Node.js API. Those are the ingredients we will put in an image.
Lesson completed