Key Takeaways
- A container is a process wrapped in a standard packaging format.
- Containers share the host kernel; virtual machines do not.
- Images are immutable, layered filesystems described by a Dockerfile.
- The value is reproducibility and consistent deployment, not isolation.
- Docker on a laptop is the same idea, not the same runtime, as Kubernetes.
What A Container Actually Is
A container is a normal Linux process running with a private view of the filesystem, network and process tree. The isolation is provided by kernel features that already existed — namespaces and cgroups — packaged behind a friendly interface.
Because the container is just a process, it starts in milliseconds and uses very little overhead compared to a virtual machine.
Containers vs Virtual Machines
| Property | Container | Virtual Machine |
|---|---|---|
| Boot time | Milliseconds | Seconds to minutes |
| Overhead | Very low | Meaningful |
| Isolation | Process-level | Machine-level |
| Portability | High | Medium |
| Best for | Application delivery | Full OS isolation |
A Minimal Dockerfile
- FROM a small base image, for example a language runtime.
- COPY only what you need for the build.
- RUN the build in a first stage.
- Use a smaller runtime stage and COPY built artefacts across.
- EXPOSE the port and set a non-root USER.
- Use CMD, not ENTRYPOINT, unless you truly need the difference.
Real-World Use
- Every serious backend team ships as containers today.
- Data pipelines package their code as containers to run on Kubernetes or on managed platforms.
- CI systems run each build inside a container for reproducibility.
- Local development environments are increasingly reproducible via Docker Compose or dev containers.
Common Mistakes
- Building images as root without a runtime user.
- Baking secrets into layers.
- Missing .dockerignore, shipping node_modules and build caches.
- Using latest tags in production.
- Ignoring image size and cold-start time.
Final Summary
Docker made deployment boring in the best possible way. Learn the fundamentals, respect the discipline it requires and it becomes one of the most reliable tools in a developer's toolkit.
