Containers and Docker

What is a container?

A container packages an application with everything it needs (runtime, libraries, files) and runs it as an isolated process on a shared Linux kernel. It starts in milliseconds and behaves the same on a laptop, in CI and in production.

• An image is the read-only template (layers of files plus metadata).
• A container is a running instance of an image, with its own writable layer that is lost when it's removed.

Everyday commands

docker build -t api:dev .                    # build an image from ./Dockerfile
docker run -d --name api -p 8080:8080 api:dev
docker ps                                    # running containers
docker logs -f api                           # follow its output
docker exec -it api sh                       # a shell inside the container
docker stop api && docker rm api
docker images && docker image prune          # list and clean up images

Containers are processes

Limits come from Linux cgroups: docker run --memory 512m --cpus 1.5. A container that exceeds its memory limit is killed (OOMKilled, exit code 137). Anything written inside the container is lost on removal; use volumes for data that must survive.

codes = {0: "exited normally", 1: "application error", 126: "command not executable",
         127: "command not found", 137: "killed by SIGKILL (often OOMKilled: memory limit exceeded)",
         143: "stopped by SIGTERM (normal docker stop / pod termination)"}
for code, meaning in codes.items():
    print(f"exit {code:3}: {meaning}")
print("128 + signal number: 128 + 9 (SIGKILL) = 137, 128 + 15 (SIGTERM) = 143")

exit   0: exited normally
exit   1: application error
exit 126: command not executable
exit 127: command not found
exit 137: killed by SIGKILL (often OOMKilled: memory limit exceeded)
exit 143: stopped by SIGTERM (normal docker stop / pod termination)
128 + signal number: 128 + 9 (SIGKILL) = 137, 128 + 15 (SIGTERM) = 143