Docker & Containers
What it is & where it is used
Docker packages an application with everything it needs (runtime, libraries, config) into a container image that runs the same on a laptop, CI server or cloud. A container is a running instance of an image — an isolated process that shares the host's OS kernel.
| Virtual machine | Container | |
|---|---|---|
| Isolation | Full guest OS on a hypervisor | Process isolation via kernel namespaces + cgroups |
| Size | GBs | MBs |
| Start time | Minutes | Seconds or less |
| Density | Few per host | Many per host |
| OS | Any guest OS | Shares host kernel (Linux containers on Linux; Windows containers on Windows) |
Key pieces: Docker Engine (daemon dockerd + CLI), images, containers, Dockerfile, registries (Docker Hub, Azure Container Registry, GitHub Container Registry), volumes, networks, Docker Compose. Standards: the OCI (Open Container Initiative) image and runtime specs; low-level runtimes containerd and runc.
Versions & history
| Year | Milestone |
|---|---|
| 2008 | Linux Containers (LXC) |
| 2013 | Docker open-sourced by dotCloud (PyCon demo) |
| 2014 | Docker 1.0; Docker Compose (from Fig) |
| 2015 | Open Container Initiative (OCI) founded; Docker Swarm |
| 2016 | Docker for Mac/Windows; Windows Server containers |
| 2017 | Multi-stage builds (17.05); Moby project; containerd donated to CNCF; version scheme YY.MM |
| 2019 | Docker Enterprise sold to Mirantis |
| 2020 | BuildKit default path; Compose Specification |
| 2021 | Docker Desktop requires a paid subscription for larger companies (>250 employees or >$10M revenue) |
| 2022 | Kubernetes removes dockershim (v1.24) — Docker-built images still run fine |
| 2023 | Docker Compose v2 (docker compose) replaces docker-compose; Docker Scout; Docker Init |
| 2024–2025 | Docker Engine 27/28: Docker Build Cloud, Docker Desktop AI features, hardened images |
.NET images: mcr.microsoft.com/dotnet/sdk (build), aspnet (ASP.NET Core runtime), runtime (console apps), runtime-deps (self-contained/AOT). Since .NET 8 they run as a non-root app user and default to port 8080.
Lifecycle
Container lifecycle:
docker create → Created → docker start → Running → docker pause → Paused → docker unpause → Running → docker stop (SIGTERM, then SIGKILL after 10 s) → Exited → docker start again or docker rm → Removed. docker run = create + start. docker kill sends SIGKILL immediately. Restart policies: no, on-failure, always, unless-stopped.
Image lifecycle: write Dockerfile → docker build (each instruction creates a cached layer) → docker tag → docker push to a registry → docker pull on the target → docker run → update → rebuild/retag → prune old images.
Dev-to-prod flow: code → Dockerfile → CI builds and tests the image → scan for vulnerabilities → push with an immutable tag (git SHA) → deploy to Kubernetes/Azure Container Apps/App Service → monitor.
Tools used to develop
| Tool | Use |
|---|---|
| Docker Desktop (Windows/Mac), Docker Engine (Linux) | Run containers locally |
| Podman, Rancher Desktop, colima | Docker alternatives |
| Docker Compose | Multi-container apps for dev/test |
BuildKit / docker buildx | Fast, multi-platform builds |
| Visual Studio container tools, VS Code Dev Containers / Container Tools | Build, debug in containers |
.NET SDK container publishing (dotnet publish -t:PublishContainer) | Build images without a Dockerfile |
| Azure Container Registry, Docker Hub, GHCR | Registries |
| Docker Scout, Trivy, Grype, Microsoft Defender for Containers | Vulnerability scanning |
| Hadolint | Dockerfile linting |
| Dive | Inspect image layers |
| Testcontainers | Real dependencies in integration tests |