Images, containers and the engine

What an image is, what a container is, and the everyday commands for starting, listing and removing them.

Image

Also called container image, OCI image

What: A read-only bundle of filesystem layers plus metadata (default command, environment, exposed ports, user). Images follow the OCI format, so any compliant runtime can run them.
Why: An image is the unit you build once and ship everywhere: a laptop, CI and production all run the same bytes.

Watch out

Treating an image as a VM snapshot and changing a running container by hand; rebuild the image instead so the change is recorded.

Container

What: A running (or stopped) instance of an image: an isolated process with a thin writable layer on top of the image. Linux namespaces isolate it and cgroups cap its resources.
Why: Many containers can run from one image, each with its own state, network identity and limits, and each starts in about the time its process takes to boot.

Watch out

Storing data in the writable layer: it disappears when the container is removed.

Docker Engine, containerd and runc

Also called dockerd, OCI runtime

What: The docker CLI talks to the dockerd daemon, which hands containers to containerd, which starts them with an OCI runtime such as runc. Docker Desktop runs all of this in a small Linux VM on macOS and Windows.
Why: Knowing the layers explains why Kubernetes can run your images without Docker installed, and why file mounts are slower on Docker Desktop.

Watch out

Adding a user to the docker group casually: access to the daemon socket is effectively root on the host.

docker run

What: Creates and starts a container from an image. Common flags: -d detached, --name, -p publish a port, -e set a variable, -v mount storage, --rm delete on exit, -it interactive terminal.
Why: It is the single command behind most local experiments, one-off tools and quick checks of an image.

Shell

docker run -d --name web -p 8080:80 nginx:1.27
docker run --rm -it python:3.13-slim python
docker run --rm -v "$PWD":/work -w /work \
  node:22-slim npm test

Watch out

Forgetting --rm on throwaway runs, which leaves hundreds of stopped containers behind.

Publishing ports

Also called -p, port mapping

What: -p host:container forwards a host port to a port inside the container. -p 127.0.0.1:5432:5432 binds only to localhost. EXPOSE in a Dockerfile documents a port but publishes nothing.
Why: Without publishing, a container is reachable only from other containers on its network.

Watch out

Publishing a database with -p 5432:5432 on a server: it binds every interface, and Docker's iptables rules can bypass host firewalls such as ufw.

Container lifecycle commands

Also called docker ps, docker stop

What: A container moves through created, running, paused, exited and removed. docker stop sends SIGTERM then SIGKILL after a grace period; docker kill sends SIGKILL at once.
Why: Knowing which state a container is in, and how it stopped, is the first step in every "why is it not running" question.

Shell

docker ps -a
docker stop web
docker start web
docker rm -f web
docker ps -a --filter status=exited

Tags and digests

Also called sha256, image reference

What: A full reference is registry/namespace/name:tag@digest. A tag is a movable label; a digest is the content hash and never changes. With no registry, Docker assumes Docker Hub; with no tag, latest.
Why: Pinning by digest makes builds and deploys reproducible even if someone re-pushes a tag.
Example: ghcr.io/acme/api:1.8.2 is readable; ghcr.io/acme/api@sha256:4f1c... is exact. latest only means "the last push without a tag", not "newest".

Go deeper