Docker.

Docker is a containerization platform that packages an application and its dependencies into lightweight, portable containers. Unlike virtual machines (VMs), which virtualize an entire operating system, Docker containers share the host OS kernel while keeping each application isolated.

The key differences:

• Containers use fewer resources, because they share the host kernel.
• Containers start in seconds, while VMs take minutes.
• Containers run the same way across different environments.
• VMs give stronger isolation, but at a higher overhead cost.

Docker uses a client-server architecture. The docker CLI is the client. It sends each command over a REST API to the Docker daemon, dockerd, which builds, runs and distributes containers.

Its main components:

• The Docker client is the command-line interface, and it can talk to a local or remote daemon.
• The Docker daemon is a background service that manages containers, images and networks.
• An image is a read-only template used to create containers.
• A container is a running instance of an image.
• A registry stores images. Docker Hub is the default public registry, and you can also run a private one.
• Docker Engine is the complete platform: the daemon, its REST API and the CLI.

Below the daemon, containerd manages each container's lifecycle, and it uses runc to create the container itself.

A Docker image is a read-only template that holds the application code together with its runtime, libraries and dependencies. A Docker container is a running instance of an image.

The key differences:

• An image is an immutable blueprint. A container is a mutable runtime environment, with its own writable layer on top of the image.
• You store and share an image. A container is what runs your application's process.
• You can create many containers from a single image.
• Changes made inside a container don't affect the original image.

For example:

# Image exists as a template
docker images
# Container is created and runs from image
docker run nginx

Docker's main benefit is consistency. An image carries the app together with its dependencies, so code that works on a developer's machine behaves the same in testing and production.

Other benefits:

• Applications run anywhere Docker is installed, which makes them portable.
• Scaling out means starting more containers from the same image.
• Containers share the host kernel and run no guest OS, so they need fewer resources than a traditional virtual machine.
• Setting up a development environment is instant, so development cycles are faster.
• Each service runs in its own container, which suits breaking a monolith into microservices.
• CI/CD pipelines build, test and deploy the same image at every stage.

Use docker run, which creates a container from an image and starts it in one step. If the image isn't on the host yet, Docker first pulls it from the registry.

docker run does the work of two commands. docker create makes the container by adding a writable layer on top of the image, and docker start runs its main process. Docker also connects the container to the default network unless you choose another one.

The flags below name the container, publish a port, and run it detached or interactively.

# Basic container creation
docker run nginx
# Run with custom name and port mapping
docker run --name my-nginx -p 8080:80 nginx
# Run in background (detached mode)
docker run -d --name web-server nginx
# Run interactively
docker run -it ubuntu bash

When the main process exits, the container stops but isn't removed, so you can start it again later.