Docker — Cheat Sheet

Tags: docker, containers, devops, compose, ci-cd, infrastructure

Level: intermediate

TL;DR: Core containerization concepts, lifecycle management, networking, storage, and optimization for production and CI/CD pipelines.

Key concepts

Containers package code, runtime, system tools, and libraries sharing the host OS kernel.

Images are immutable multi-layered templates defined via Dockerfile instructions.

Containers represent running, stateful instances of an underlying immutable image.

Image layers use copy-on-write semantics; unchanged layers are cached during builds.

Volumes persist container data directly on the host filesystem independently of lifecycle.

Bind mounts map an exact host file or directory into the container filesystem.

Bridge networks provide default software-isolated internal routing between containers on a single host.

Multi-stage builds separate build dependencies from the final lightweight deployment artifact.

Docker Compose defines and orchestrates multi-container configurations through declarative YAML files.

The Docker daemon (dockerd) manages images, containers, networks, and storage volumes via API.

Typical questions and ready answers

Q: What is the fundamental difference between a Docker container and a Virtual Machine?R: VMs virtualize hardware and run a complete guest OS on top of a hypervisor. Containers share the host Linux kernel and isolate user space, starting in milliseconds with minimal overhead.

Q: How do you optimize Docker image build times and overall image size?R: I leverage multi-stage builds, pin minimal base images like Alpine or Distroless, combine consecutive RUN commands, and order Dockerfile steps from least to most frequently changing to maximize layer caching.

Q: When should you use a Volume versus a Bind Mount?R: I use Volumes for database persistence and production state managed entirely by Docker. I reserve Bind Mounts for local development when source code needs live-reloading from host to container.

Q: What is the difference between CMD and ENTRYPOINT in a Dockerfile?R: ENTRYPOINT defines the immutable core executable to launch. CMD provides default arguments that can be completely overridden when executing docker run.

Pitfalls and common mistakes

Running containers as the root user in production environments instead of dropping privileges via USER.

Copying source code before dependency definitions (package.json, go.mod), which breaks layer caching on every code edit.

Storing active production application state inside the container writable layer instead of an attached volume.

Failing to include a .dockerignore file, causing heavy folders like node_modules or .git to bloat the build context.

Using the latest tag in production pipelines instead of explicit semantic versioning or immutable commit SHAs.

Using ADD instead of COPY when extracting remote files or archives is not strictly required.

Leaving zombie processes running as PID 1 that fail to handle UNIX signals (SIGTERM, SIGINT) properly.

Snippets and commands

# Build an image with a specific tag using current context
docker build -t app:1.0.0 .

# Run a detached container with host port binding and volume mount
docker run -d --name web -p 8080:80 -v app_data:/data app:1.0.0

# View container logs with continuous follow and timestamp output
docker logs -f --tail 100 web

# Execute an interactive shell session inside an active container
docker exec -it web /bin/sh

# Stop and purge stopped containers, unused networks, and dangling images
docker system prune -f

# Manage multi-container environment lifecycle via Docker Compose
docker compose up -d
docker compose down -v

Dockerfile

# Multi-stage build example for Node.js application
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
USER node
COPY --chown=node:node package*.json ./
RUN npm ci --only=production
COPY --chown=node:node --from=builder /app/dist ./dist
EXPOSE 3000
CMD ["node", "dist/index.js"]

To review

[ ] Container security hardening (read-only root filesystem, non-root user, capabilities dropping).

[ ] Layer cache optimization strategies in remote CI/CD pipelines (e.g. BuildKit cache-from).

[ ] Internal DNS service discovery mechanics within custom Docker bridge networks.

[ ] Differences between bridge, host, macvlan, and none network drivers.

[ ] Healthcheck configuration in Dockerfile and Compose for zero-downtime orchestration.

References

Docker Engine Official Documentation: https://docs.docker.com/engine/

Dockerfile Best Practices Guide: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/

OCI (Open Container Initiative) Image and Runtime Specifications