Glossary

Every concept in this sheet, plus the smaller terms it uses. Select a concept to open its card.

CMD vs ENTRYPOINT: ENTRYPOINT is the executable the container always runs; CMD gives default arguments, replaced by anything after the image name in docker run.
Container: A running (or stopped) instance of an image: an isolated process with a thin writable layer on top of the image.
Container lifecycle commands: A container moves through created, running, paused, exited and removed.
COPY vs ADD: COPY copies files from the build context into the image.

Docker Engine, containerd and runc: The docker CLI talks to the dockerd daemon, which hands containers to containerd, which starts them with an OCI runtime such as runc.
docker run: Creates and starts a container from an image.

Exec form and PID 1: Exec form ["node", "server.js"] runs the process directly as PID 1.

FROM and base images: FROM picks the starting image and begins a build stage.

HEALTHCHECK: An instruction that runs a command inside the container on an interval.

Image: A read-only bundle of filesystem layers plus metadata (default command, environment, exposed ports, user).

LABEL and OCI annotations: Key and value metadata stored in the image, such as org.opencontainers.image.source and org.opencontainers.image.revision.

Publishing ports: -p host:container forwards a host port to a port inside the container.

RUN: Executes a command at build time and saves the filesystem changes as a new layer.