Master Docker Operations: Core Concepts, Commands & Production Best Practices

Problem Background

Container technology has become the standard for modern application deployment. Docker, as the representative container technology, has permeated all aspects of operations work from development to production environments. Traditional operations engineers managed physical machines and virtual machines with complex environment dependencies; now most of this work is replaced by Docker images and containers.

However, containerization does not mean operations work becomes simpler. On the contrary, operations engineers need to master a series of new skills: image building, container management, network configuration, data persistence, log collection, resource limits, and security hardening. Production container troubleshooting, performance optimization, canary releases, and rollback strategies all require deep Docker understanding.

This article takes a practical approach, systematically covering Docker core concepts, common commands, best practices, and production considerations to help operations engineers quickly master core containerized operations skills.

Applicable Scenarios

Deploying and managing Docker containers in production

Building and optimizing Docker images

Troubleshooting Docker container failures

Container performance tuning and resource limiting

Managing container networks and data persistence

Operations teams migrating from virtual machines to containers

Engineers needing to understand containerized operations best practices

Core Knowledge Points

3.1 Docker Core Concepts

Image

An image is a read-only template containing code, runtime, libraries, environment variables, and configuration files needed to run an application. Images are layered; each layer is read-only and can be shared by multiple images.

Container

A container is a running instance of an image. Containers can be created, started, stopped, and deleted. Containers are isolated from each other but share the host kernel.

Registry

Registries store and distribute images. Docker Hub is the largest public registry; enterprises typically build private registries (Harbor, Nexus, etc.).

Volume

Volumes persist container data; data remains even if the container is deleted.

Network

Docker provides multiple network modes (bridge, host, none, overlay, etc.); containers communicate via networks.

3.2 Docker vs Virtual Machines

Startup Speed : Docker containers start in seconds; virtual machines take minutes

Resource Usage : Docker has low overhead (shared kernel); VMs have high overhead (independent kernel per VM)

Isolation : Docker provides process-level isolation; VMs provide system-level isolation

Portability : Docker images run anywhere; VMs depend on virtualization platform

Performance : Docker runs near-native; VMs have virtualization overhead

3.3 Docker Architecture

Docker Client: Users interact via CLI or API

Docker Daemon: Background service responsible for building, running, and distributing containers

Docker Registry: Image repository

Docker Objects: Images, containers, networks, volumes, etc.

3.4 Container Lifecycle

Create → Start → Run → Pause/Resume → Stop → Delete

Docker Common Operations

4.1 Image Operations

List Local Images

docker images
# or
docker image ls

Output example:

REPOSITORY    TAG       IMAGE ID       CREATED        SIZE
nginx         latest    605c77e624dd   2 weeks ago    141MB
mysql         5.7       c20987f18b13   3 weeks ago    448MB
redis         alpine    a6d3c9a6b9dc   1 month ago    32.3MB

Columns: REPOSITORY (repository name), TAG (version tag), IMAGE ID (unique identifier), CREATED (creation time), SIZE (image size).

Search Images

docker search nginx

Pull Images

# Pull latest
docker pull nginx

# Pull specific version
docker pull nginx:1.21

# Pull from specific registry
docker pull registry.example.com/nginx:1.21

Remove Images

# Remove specific image
docker rmi nginx:latest

# Force remove
docker rmi -f nginx:latest

# Remove all unused images
docker image prune

# Remove all images
docker rmi $(docker images -q)

Build Images

# Build from Dockerfile
docker build -t myapp:v1.0 .

# Specify Dockerfile path
docker build -t myapp:v1.0 -f /path/to/Dockerfile .

# Build without cache
docker build --no-cache -t myapp:v1.0 .

Export and Import Images

# Export image to file
docker save -o nginx.tar nginx:latest

# Import image from file
docker load -i nginx.tar

Inspect Image Details

docker inspect nginx:latest

View Image Build History

docker history nginx:latest

4.2 Container Operations

Run Containers

# Basic run
docker run nginx

# Detached mode
docker run -d nginx

# Specify container name
docker run -d --name my-nginx nginx

# Port mapping
docker run -d -p 8080:80 nginx

# Mount volume
docker run -d -v /data:/usr/share/nginx/html nginx

# Set environment variable
docker run -d -e MYSQL_ROOT_PASSWORD=secret mysql:5.7

# Limit resources
docker run -d --memory="512m" --cpus="0.5" nginx

# Interactive mode
docker run -it ubuntu bash

# Auto-remove on exit
docker run --rm nginx

List Containers

# Running containers
docker ps

# All containers (including stopped)
docker ps -a

# Only container IDs
docker ps -q

# Show container sizes
docker ps -s

Output example:

CONTAINER ID   IMAGE     COMMAND                  CREATED         STATUS         PORTS                  NAMES
a1b2c3d4e5f6   nginx     "/docker-entrypoint.…"   2 minutes ago   Up 2 minutes   0.0.0.0:8080->80/tcp   my-nginx

Stop and Start Containers

# Stop container
docker stop my-nginx

# Force stop
docker kill my-nginx

# Start stopped container
docker start my-nginx

# Restart container
docker restart my-nginx

Remove Containers

# Remove stopped container
docker rm my-nginx

# Force remove running container
docker rm -f my-nginx

# Remove all stopped containers
docker container prune

# Remove all containers
docker rm -f $(docker ps -aq)

Enter Containers

# Using exec (recommended)
docker exec -it my-nginx bash

# If no bash available
docker exec -it my-nginx sh

# Execute single command
docker exec my-nginx ls /etc/nginx

# Using attach (not recommended, exit stops container)
docker attach my-nginx

View Container Logs

# View logs
docker logs my-nginx

# Follow logs in real-time
docker logs -f my-nginx

# Last 100 lines
docker logs --tail 100 my-nginx

# Logs since specific time
docker logs --since 2024-01-01T00:00:00 my-nginx

Inspect Container Details

docker inspect my-nginx

View Container Resource Usage

# All containers
docker stats

# Specific container
docker stats my-nginx

# Single snapshot (no stream)
docker stats --no-stream

Output example:

CONTAINER ID   NAME       CPU %   MEM USAGE / LIMIT   MEM %   NET I/O       BLOCK I/O   PIDS
a1b2c3d4e5f6   my-nginx   0.02%   2.5MiB / 1.952GiB   0.12%   1.2kB / 648B  0B / 0B     2

Copy Files Between Container and Host

# Container to host
docker cp my-nginx:/etc/nginx/nginx.conf /tmp/

# Host to container
docker cp /tmp/nginx.conf my-nginx:/etc/nginx/

View Container Processes

docker top my-nginx

4.3 Volume Operations

Create Volume

docker volume create my-vol

List Volumes

docker volume ls

Inspect Volume

docker volume inspect my-vol

Use Volumes

# Mount named volume
docker run -d -v my-vol:/data nginx

# Mount host directory
docker run -d -v /host/path:/container/path nginx

# Read-only mount
docker run -d -v my-vol:/data:ro nginx

Remove Volumes

# Remove specific volume
docker volume rm my-vol

# Remove all unused volumes
docker volume prune

4.4 Network Operations

List Networks

docker network ls

Output example:

NETWORK ID     NAME      DRIVER    SCOPE
a1b2c3d4e5f6   bridge    bridge    local
b2c3d4e5f6a7   host      host      local
c3d4e5f6a7b8   none      null      local

Create Network

# Create bridge network
docker network create my-net

# Specify subnet
docker network create --subnet=172.18.0.0/16 my-net

Inspect Network

docker network inspect my-net

Connect Container to Network

# Run with network
docker run -d --network my-net --name web nginx

# Connect running container
docker network connect my-net my-nginx

# Disconnect network
docker network disconnect my-net my-nginx

Remove Network

docker network rm my-net

4.5 Dockerfile Writing

Basic Structure

# Base image
FROM ubuntu:20.04

# Maintainer
LABEL maintainer="[email protected]"

# Environment variable
ENV APP_HOME=/app

# Working directory
WORKDIR /app

# Copy files
COPY app.jar /app/

# Add files (supports URL and auto-extract)
ADD https://example.com/file.tar.gz /app/

# Run commands
RUN apt-get update && \
    apt-get install -y openjdk-11-jre && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Expose port
EXPOSE 8080

# Mount point
VOLUME ["/data"]

# Startup command
CMD ["java", "-jar", "/app/app.jar"]

# Or use ENTRYPOINT
ENTRYPOINT ["java"]
CMD ["-jar", "/app/app.jar"]

Best Practice Example

FROM openjdk:11-jre-slim

# Use non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser

WORKDIR /app

# Copy dependencies and code in layers to leverage cache
COPY pom.xml /app/
RUN mvn dependency:go-offline

COPY src /app/src
RUN mvn package

# Keep only necessary files
RUN mv target/app.jar /app/ && \
    rm -rf target src pom.xml

# Switch user
USER appuser

EXPOSE 8080

CMD ["java", "-Xmx512m", "-jar", "/app/app.jar"]

Docker Compose

5.1 Basic Concepts

Docker Compose defines and runs multi-container applications. Services, networks, and volumes are configured via YAML; a single command starts the entire application stack.

5.2 docker-compose.yml Example

version: '3.8'

services:
  web:
    image: nginx:latest
    ports:
      - "8080:80"
    volumes:
      - ./html:/usr/share/nginx/html
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    networks:
      - frontend
    depends_on:
      - app
    restart: always

  app:
    build:
      context: ./app
      dockerfile: Dockerfile
    environment:
      - DB_HOST=db
      - DB_PORT=3306
      - DB_USER=root
      - DB_PASSWORD=secret
    volumes:
      - app-logs:/var/log/app
    networks:
      - frontend
      - backend
    restart: always

  db:
    image: mysql:5.7
    environment:
      - MYSQL_ROOT_PASSWORD=secret
      - MYSQL_DATABASE=mydb
    volumes:
      - db-data:/var/lib/mysql
    networks:
      - backend
    restart: always

networks:
  frontend:
  backend:

volumes:
  app-logs:
  db-data:

5.3 Common Commands

# Start all services
docker-compose up -d

# Stop all services
docker-compose down

# View service status
docker-compose ps

# View logs
docker-compose logs -f

# Restart services
docker-compose restart

# Build images
docker-compose build

# Execute command in service
docker-compose exec app bash

# Scale service instances
docker-compose up -d --scale app=3

Production Best Practices

6.1 Image Optimization

Use Small Base Images

# Not recommended
FROM ubuntu:20.04

# Recommended
FROM alpine:3.18
# Or
FROM debian:bullseye-slim

Multi-stage Builds

# Build stage
FROM golang:1.20 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp

# Runtime stage
FROM alpine:3.18
COPY --from=builder /app/myapp /usr/local/bin/
CMD ["myapp"]

Combine RUN Commands

# Not recommended
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get clean

# Recommended
RUN apt-get update && \
    apt-get install -y curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Use .dockerignore

# .dockerignore
.git
.gitignore
*.md
node_modules
.env
*.log

6.2 Security Hardening

Use Non-root User

RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

Read-only Filesystem

docker run -d --read-only --tmpfs /tmp nginx

Limit Container Capabilities

docker run -d --cap-drop=ALL --cap-add=NET_BIND_SERVICE nginx

Scan Image Vulnerabilities

# Using Trivy
trivy image nginx:latest

# Using Docker Scan
docker scan nginx:latest

6.3 Resource Limits

Limit Memory

docker run -d --memory="512m" --memory-swap="1g" nginx

Limit CPU

docker run -d --cpus="0.5" nginx
docker run -d --cpu-shares=512 nginx

Limit Disk I/O

docker run -d --blkio-weight=100 nginx

6.4 Log Management

Configure Log Driver

docker run -d --log-driver=json-file --log-opt max-size=10m --log-opt max-file=3 nginx

Log Driver Types

json-file

: Default, outputs to JSON files syslog: Outputs to syslog journald: Outputs to systemd journal fluentd: Outputs to Fluentd awslogs: Outputs to AWS CloudWatch

Centralized Log Collection

Use ELK (Elasticsearch + Logstash + Kibana) or Loki + Grafana to collect container logs.

6.5 Health Checks

Define in Dockerfile

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost/ || exit 1

Specify at Runtime

docker run -d --health-cmd="curl -f http://localhost/ || exit 1" \
  --health-interval=30s \
  --health-timeout=3s \
  --health-retries=3 \
  nginx

View Health Status

docker inspect --format='{{.State.Health.Status}}' my-nginx

6.6 Restart Policies

# No restart (default)
docker run -d --restart=no nginx

# Always restart
docker run -d --restart=always nginx

# Restart on failure
docker run -d --restart=on-failure nginx

# Restart on failure, max 5 times
docker run -d --restart=on-failure:5 nginx

# Restart unless manually stopped
docker run -d --restart=unless-stopped nginx

Troubleshooting

7.1 Container Fails to Start

Check Container Status

docker ps -a

Check Startup Logs

docker logs <container_id>

Inspect Container Details

docker inspect <container_id>

Common Causes

Port conflicts

Volume mount failures

Environment variable misconfiguration

Dependent services not started

Corrupted images

7.2 Container Frequent Restarts

Check Restart Count

docker inspect --format='{{.RestartCount}}' my-nginx

Check Exit Code

docker inspect --format='{{.State.ExitCode}}' my-nginx

Common Exit Codes

0: Normal exit

1: Application error

137: Killed by SIGKILL (usually OOM)

139: Segmentation fault

7.3 Container Performance Issues

Check Resource Usage

docker stats

Check Container Processes

docker top my-nginx

Enter Container for Diagnosis

docker exec -it my-nginx bash
top
free -h
df -h

7.4 Network Issues

Check Container IP

docker inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' my-nginx

Test Network Connectivity

docker exec my-nginx ping baidu.com
docker exec my-nginx curl http://another-container:8080

Check Port Mapping

docker port my-nginx

Common Issues and Solutions

8.1 Slow Image Pulls

Cause

Docker Hub is slow to access from China.

Solution

Configure registry mirrors. Edit /etc/docker/daemon.json:

{
  "registry-mirrors": [
    "https://mirror.ccs.tencentyun.com",
    "https://docker.mirrors.ustc.edu.cn"
  ]
}

Restart Docker:

sudo systemctl restart docker

8.2 Container Data Loss

Cause

Deleting a container also deletes data inside it.

Solution

Use volumes for persistence:

docker run -d -v db-data:/var/lib/mysql mysql:5.7

8.3 Container Timezone Mismatch

Cause

Container timezone differs from host.

Solutions

Method 1: Mount timezone file

docker run -d -v /etc/localtime:/etc/localtime:ro nginx

Method 2: Set environment variable docker run -d -e TZ=Asia/Shanghai nginx Method 3: Set in Dockerfile

ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

8.4 Container DNS Resolution Failure

Cause

Container DNS configuration issues.

Solutions

Method 1: Specify DNS server docker run -d --dns=8.8.8.8 nginx Method 2: Configure Docker default DNS in /etc/docker/daemon.json:

{
  "dns": ["8.8.8.8", "114.114.114.114"]
}

Restart Docker.

8.5 Disk Space Exhaustion

Check Docker Disk Usage

docker system df

Output example:

TYPE            TOTAL   ACTIVE   SIZE      RECLAIMABLE
Images          10      5        2.5GB     1.2GB (48%)
Containers      20      10       500MB     300MB (60%)
Local Volumes   5       2        1GB       800MB (80%)
Build Cache     0       0        0B        0B

Clean Unused Resources

# Clean stopped containers
docker container prune

# Clean unused images
docker image prune

# Clean unused volumes
docker volume prune

# Clean unused networks
docker network prune

# Clean all unused resources
docker system prune -a

Production Considerations

9.1 Image Management

Use private registries for image storage

Tag images with semantic versions; avoid latest Regularly scan images for vulnerabilities

Clean expired images to save disk space

9.2 Container Management

Set appropriate restart policies

Configure health checks

Limit container resource usage

Centralize container log collection

Monitor container status and resource usage

9.3 Data Security

Use volumes for important data persistence

Regularly back up volumes

Avoid storing sensitive information inside containers

Use Secrets for passwords and keys

9.4 Network Security

Use custom networks to isolate containers

Restrict inter-container access

Do not expose unnecessary ports

Use firewall rules to limit access

9.5 Updates and Rollbacks

Use rolling updates to avoid downtime

Retain old image versions for quick rollback

Canary deploy new versions

Thoroughly test before full rollout

Summary

Docker containerized operations is a core skill for modern operations, requiring mastery of:

Basic image and container operations

Dockerfile writing and image optimization

Volume and network management

Resource limits and security hardening

Log collection and monitoring

Troubleshooting and performance optimization

Production best practices

Containerized operations is not just about learning Docker commands; more importantly, it requires understanding container principles, mastering production best practices, and possessing the ability to quickly troubleshoot issues.

With the widespread adoption of Kubernetes, Docker's role as a container runtime is evolving, but Docker's core concepts and operations remain the foundation of Kubernetes operations. Mastering Docker is the first step into the containerized era.