Docker basics: images, containers and the commands you need

Docker packages an application together with everything it needs to run, such as the language runtime, system libraries and config, so it behaves the same on your laptop, a colleague’s machine and a server. Two words are central: image and container.

Image vs container

• An image is a read-only template, built in layers. Think of it as a class, or an installer. Examples: nginx:1.27, python:3.12-slim, postgres:16.
• A container is a running (or stopped) instance of an image, with its own writable layer, processes and network. Think of it as an object created from the class. You can run many containers from one image.

The part after the colon is the tag. If you leave it out, Docker uses latest, which can change under you. Pin a specific tag for anything you depend on.

Running your first container

docker run --rm -it python:3.12-slim python    # interactive Python, removed on exit

docker run -d --name web -p 8080:80 nginx:1.27  # web server in the background

What the flags do:

• -d runs detached (in the background).
• --name web gives the container a name you can use instead of its ID.
• -p 8080:80 maps port 8080 on your machine to port 80 inside the container. Host first, container second.
• --rm deletes the container when it stops.
• -it gives you an interactive terminal.
• -e KEY=value sets an environment variable; -v mounts a folder or volume.

Open http://localhost:8080 and you should see the nginx welcome page.

Looking around

docker ps                 # running containers
docker ps -a              # include stopped ones
docker logs web           # output of the container's main process
docker logs -f web        # follow new output
docker exec -it web sh    # open a shell inside the running container
docker images             # images on this machine

docker exec runs an extra command in a container that is already running, which is the normal way to poke around inside. Small images may not include bash, so try sh.

Stopping and cleaning up

docker stop web          # graceful stop
docker start web         # start it again, same container
docker rm web            # delete the stopped container
docker rmi nginx:1.27    # delete the image
docker system df         # how much space Docker uses

Anything a container writes to its own filesystem is lost when the container is removed. Keep data you care about in a volume (-v pgdata:/var/lib/postgresql/data) or a bind-mounted folder (-v "$PWD":/app).

Building your own image

A Dockerfile lists the steps to build an image:

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "app.py"]

docker build -t myapp:dev .
docker run --rm -p 8000:8000 myapp:dev

Copying requirements.txt before the rest of the code lets Docker reuse the cached dependency layer when only your code changes. Add a .dockerignore file listing things like .git and node_modules to keep builds small.

"permission denied while trying to connect to the Docker daemon socket"

On Linux, the docker command talks to a background service through the socket /var/run/docker.sock, which by default only root and members of the docker group may use. Either prefix commands with sudo, or add yourself to the group with sudo usermod -aG docker $USER and then log out and back in. Be aware that membership in the docker group effectively grants root-level access to the machine. Rootless mode is an alternative if that matters. On macOS and Windows, this error usually means Docker Desktop is not running yet.