🐳 Docker Beginner to Advanced – Single Markdown

Real-World Examples

VMs Used In:

• AWS EC2, Azure VM
• Running Windows + Linux on same server
• Banking and enterprise systems

Containers Used In:

• Docker
• Kubernetes
• Microservices like Netflix, Uber, Spotify
• CI/CD pipelines

🧠 How Containers Actually Work (Under the Hood)

Containers are not virtual machines. They don't have their own kernel.
Instead, they use Linux kernel features — primarily Namespaces and Cgroups — to create isolated environments that feel like separate machines.

🔹 1. Linux Namespaces (Isolation)

Namespaces provide isolation — they control what a container can see.
Each container gets its own isolated view of system resources.

How Namespaces Work — Example

When Docker runs a container, it essentially calls the Linux clone() syscall with namespace flags:

// Simplified — what Docker does under the hood
clone(container_main, stack,
    CLONE_NEWPID | CLONE_NEWNET | CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC,
    args);

Result: The process inside the container thinks it's the only process (PID 1), has its own network, its own filesystem, and its own hostname — all while sharing the same kernel as the host.

Verify Namespaces on Your Host

# List namespaces of a running container
docker inspect --format '{{.State.Pid}}' <container_name>

# Then check its namespaces
ls -la /proc/<PID>/ns/

Output:

lrwxrwxrwx 1 root root 0 ... cgroup -> cgroup:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... ipc    -> ipc:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... mnt    -> mnt:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... net    -> net:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... pid    -> pid:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... user   -> user:[4026532xyz]
lrwxrwxrwx 1 root root 0 ... uts    -> uts:[4026532xyz]

🔹 2. Control Groups — cgroups (Resource Limiting)

Cgroups control how much resources a container can use.
While namespaces handle isolation, cgroups handle limitation.

What Cgroups Control

Docker Commands Using Cgroups

# Limit memory to 256MB and CPU to 1.5 cores
docker run -d --memory="256m" --cpus="1.5" nginx

# Limit CPU shares (relative weight, default 1024)
docker run -d --cpu-shares=512 nginx

🔹 3. Union File Systems (UnionFS / OverlayFS)

Docker images use layered filesystems. Each instruction in a Dockerfile creates a new read-only layer.
When a container runs, a thin writable layer is added on top.

┌─────────────────────────┐
│   Writable Layer                       │  ← Container (read-write)
├─────────────────────────┤
│   Layer 3: COPY app.j                  │  ← Image layer (read-only)
├─────────────────────────┤
│   Layer 2: RUN npm i                   │  ← Image layer (read-only)
├─────────────────────────┤
│   Layer 1: apt install                 │  ← Image layer (read-only)
├─────────────────────────┤
│   Base: ubuntu:22.04                   │  ← Base image (read-only)
└─────────────────────────┘

Why this matters:

• Layers are shared between containers — saves disk space
• Only changed files are stored in the writable layer (copy-on-write)
• Rebuilds are fast because unchanged layers are cached

# View layers of an image
docker history nginx

# Check the storage driver in use
docker info | grep "Storage Driver"
# Common: overlay2 (default), aufs (legacy)

🔹 4. chroot (Change Root)

chroot changes the root directory for a process.
Docker uses this concept to give each container its own filesystem root /.

# Basic chroot example (non-Docker)
sudo chroot /path/to/new/root /bin/bash
# Now "/" points to /path/to/new/root

Docker goes beyond basic chroot by combining it with namespaces and cgroups,
which is why containers are far more secure than a plain chroot jail.

🔹 5. How Docker Puts It All Together

Key components:

• dockerd — Docker daemon, manages containers
• containerd — Container lifecycle manager
• runc — Low-level OCI runtime that actually creates containers using kernel primitives

What Is Docker?

Docker is a platform that lets you build, run, and manage applications in lightweight containers.
Containers include everything needed to run apps — code, libraries, runtime, and configs.

1. Install Docker

Check Docker version:

docker --version

If not installed → download from Docker Docs

Run a container in background:

docker run -d -p 80:80 docker/getting-started

Meaning:

• -d → detached mode
• -p 80:80 → hostPort:containerPort
• docker/getting-started → image name

Run container in foreground (interactive):

docker run -it -p 8001:8080 --name my-nginx nginx

Meaning:

• -it → interactive shell
• --name my-nginx → give name; if not provided, a random name is given
• nginx → image name

2. Basic Docker Commands

3. Containers

• Start a container

docker start <name/id>

• Stop a container

docker stop <name/id>

• Restart a container

docker restart <name/id>

• Kill a container

docker kill <name/id>

• Clean All

Cleans up dangling images, containers, volumes, and networks (i.e., not associated with a container)

docker system prune

Additionally, remove any stopped containers and all unused images (not just dangling images):

docker system prune -a

4. Information

5. Update

1. Create Container (without running)

docker create --name my_redis --expose 6379 redis

2. Rename an existing container

docker rename oldName newName

3. Update Resources

docker update --cpu-shares 512 -m 300M <name/id>

6. Manipulating Images

7. Docker Hub

docker login
docker push myrepo/nginx

• Commit Container → Image

docker commit containerName newImageName

• Docker Search

docker search nginx

• Logout

docker logout

8. Build Your Own Image (Dockerfile)

docker build -t myapp .

9. Docker Networking

List Networks

docker network ls

Inspect Network

docker network inspect MyNetwork

Create Network

docker network create MyNetwork

Run Container With Network

docker run -d --network MyNetwork nginx

Connect Running Container

docker network connect MyNetwork my-nginx

Disconnect

docker network disconnect MyNetwork my-nginx

Remove Network

docker network rm MyNetwork

10. Volumes (Persistent Storage)

1. Create Volume

docker volume create myVolume

2. Attach Volume

docker run -d -v myVolume:/data nginx

3. List Volumes

docker volume ls

4. Remove Unused

docker volume prune

11. Adding DNS to Docker Containers

You can control how containers resolve domain names using Docker DNS options.

Add DNS While Running a Container — use the --dns flag with docker run:

docker run -it --name myapp --dns 8.8.8.8 --dns 1.1.1.1 ubuntu bash

Meaning:

• 8.8.8.8 → Google DNS
• 1.1.1.1 → Cloudflare DNS
• Multiple DNS servers allowed (Docker tries in order)

🔎 Check DNS Inside Container

cat /etc/resolv.conf

You will see entries like:

nameserver 8.8.8.8
nameserver 1.1.1.1