Docker Day 14: A Panoramic Knowledge Map and Interview Cheat Sheet

Core Concepts

Docker host comprises images (read‑only templates), containers (running instances of images), and a registry (stores images, analogous to a Git repository).

Command Reference

Image operations

docker images          # list local images
docker pull <name>:<tag>   # pull an image
docker rmi <image>        # remove an image
docker build -t name:tag . # build an image
docker tag <image> <new>   # tag an image

Container operations

docker run -it <image> bash          # interactive run
docker run -d -p 8080:80 <image>    # daemon mode with port mapping
docker ps                           # list running containers
docker ps -a                        # list all containers
docker stop <container>            # stop container
docker start <container>           # start container
docker rm <container>               # remove container
docker exec -it <container> bash   # enter container

Docker Compose

docker compose up -d          # start services
docker compose down           # stop services
docker compose up -d --build  # rebuild and start
docker compose logs -f        # follow logs
docker compose ps             # show status

Dockerfile Instructions

FROM

– specify base image WORKDIR – set working directory COPY – copy files into the image RUN – execute commands during build CMD – default container start command EXPOSE – declare listening port ENV – define environment variables USER – set user for subsequent steps ARG – define build‑time arguments

Multi‑stage Build Example

# Build stage
FROM node:24-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Run stage
FROM nginxinc/nginx-unprivileged:alpine3.23-perl
COPY --from=builder /app/dist /usr/share/nginx/html
USER nginx
EXPOSE 8080

Network Modes

bridge

– default isolated network host – container shares host network stack none – disables networking compose – automatically created network for Docker Compose services

Data Storage Types

Volumes – Docker‑managed persistent storage

Bind mounts – map a host directory into the container

tmpfs – in‑memory filesystem

volumes:
  - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

Security Tips

# Run as non‑root user
USER nginx
# Enable read‑only root filesystem
--read-only
# Drop all capabilities, add only NET_BIND_SERVICE
--cap-drop ALL --cap-add NET_BIND_SERVICE
# Scan image for known CVEs
docker scout cves <image>

Interview Q&A

Containers vs. virtual machines

VM: full OS + hypervisor, strong isolation, slow startup (minutes)
Container: shares host kernel, weaker isolation, fast startup (seconds)

COPY vs. ADD

COPY – simple file copy, recommended
ADD – supports URLs and automatic archive extraction, use only when needed

CMD vs. ENTRYPOINT

CMD – can be overridden; arguments replace it
ENTRYPOINT – cannot be overridden; arguments are appended

Reducing image size

1. Multi‑stage builds
2. Alpine or slim base images
3. Merge RUN commands to reduce layers
4. Exclude unnecessary files via .dockerignore

Build cache invalidation

Copying the entire context (COPY . .) invalidates later layers.
Solution: copy dependency files first, then copy source code.

Diagnosing container network issues

docker exec <container> ping <other>
docker exec <container> nc -zv <host> <port>
docker network inspect bridge

Reference Links

Docker documentation: https://docs.docker.com/get-started/

Getting‑started sample project: https://github.com/docker/getting-started-todo-app