DevOps Docker Syllabus

Difference between the COPY and ADD instructions?

COPY simply copies local files/directories into the image. ADD does the same but additionally can extract local tar archives and fetch remote URLs. Best practice favors COPY unless ADD's extra features are needed.

What command builds an image from a Dockerfile and tags it?

docker build -t name:tag . — the -t flag tags the image, and the final '.' is the build context (the directory sent to the daemon).

What is a multi-stage build and why use it?

A multi-stage build uses multiple FROM stages in one Dockerfile, copying only needed artifacts from a build stage into a smaller final image. It produces lean production images by excluding build tools and dependencies.

What is the purpose of a .dockerignore file?

It lists files and directories to exclude from the build context sent to the daemon, reducing build time and image size and preventing secrets or unnecessary files from being copied in.

What is a Docker container?

A container is a runnable instance of an image — an isolated process with its own filesystem, networking, and resources. You can create, start, stop, move, and delete containers, and multiple containers can run from one image.

What is the writable container layer?

When a container starts, Docker adds a thin writable layer on top of the read-only image layers. All changes (new/modified files) are written there; this layer is deleted when the container is removed, so data is not persisted unless a volume is used.

Difference between 'docker stop' and 'docker kill'?

docker stop sends SIGTERM for a graceful shutdown, then SIGKILL after a grace period (default 10s). docker kill sends SIGKILL immediately, forcibly terminating the container.

How do you run a command inside a running container?

docker exec -it <container> <command>, e.g. docker exec -it mycontainer /bin/bash to open an interactive shell. The -it flags allocate an interactive TTY.

What is the difference between detached and foreground container mode?

Detached mode (-d) runs the container in the background and returns the container ID. Foreground (default) attaches the container's stdout/stderr to the terminal so you see its output live.

How do you publish a container port to the host?

Use -p hostPort:containerPort with docker run, e.g. docker run -p 8080:80 nginx maps host port 8080 to container port 80. Use -P to publish all exposed ports to random host ports.

List the main Docker network drivers.

bridge (default for standalone containers), host (shares the host's network stack), none (no networking), overlay (connects containers across multiple hosts in a swarm), and macvlan (assigns a MAC/IP making containers appear as physical devices).

What is the default network driver for a standalone container?

The bridge driver. Containers on the default bridge can reach each other by IP; on a user-defined bridge they can also resolve each other by container name via Docker's embedded DNS.

What advantage does a user-defined bridge network have over the default bridge?

User-defined bridges provide automatic DNS resolution between containers by name, better isolation, and the ability to attach/detach containers on the fly — features the default bridge lacks.

When would you use the host network driver?

When you want a container to share the host's network namespace directly (no network isolation), removing port-mapping overhead for maximum network performance. It is Linux-only and ports are taken directly from the host.

What is the overlay network driver used for?

It creates a distributed network spanning multiple Docker daemon hosts, allowing containers (and swarm services) on different hosts to communicate securely as if on one network. It is the standard for Docker Swarm multi-host networking.

Why are volumes preferred over storing data in the container's writable layer?

Volumes persist data independently of the container lifecycle (data survives removal), can be shared among containers, offer better performance, and are managed by Docker, whereas the writable layer is deleted with the container.

Compare Docker volumes and bind mounts.

Volumes are stored in a Docker-managed area of the host filesystem (/var/lib/docker/volumes) and are fully managed by Docker. Bind mounts map any arbitrary host path into the container and depend on the host's directory structure. Volumes are the recommended mechanism.

What is a tmpfs mount?

A tmpfs mount stores data in the host's memory only (not on disk). It is non-persistent and removed when the container stops; useful for sensitive or temporary data that should not be written to disk. Linux-only.

What command creates a named volume and how is it attached?

docker volume create mydata creates it; attach with docker run -v mydata:/path/in/container ... (or --mount source=mydata,target=/path).

What is Docker Compose?

Docker Compose is a tool for defining and running multi-container applications using a single YAML file (compose.yaml / docker-compose.yml). It lets you configure all services, networks, and volumes and start them with one command.

What command starts and stops a Compose application?

docker compose up (add -d for detached) starts all services defined in the Compose file; docker compose down stops and removes the containers, networks, and (optionally) volumes it created.

In a Compose file, what do the 'services', 'volumes', and 'networks' top-level keys define?

services defines the containers (images, ports, env, dependencies); volumes declares named volumes for persistent data; networks declares custom networks that services can join. By default Compose also creates one network for the project.

What does the 'depends_on' key control in Compose?

It controls the startup/shutdown order of services, ensuring a service starts after its dependencies. Note: it waits for the container to start, not for the service inside to be 'ready' (use healthchecks/conditions for readiness).

What is Docker Swarm?

Docker Swarm is Docker's native clustering and orchestration tool that turns a group of Docker hosts into a single virtual host, enabling deployment, scaling, and management of services across multiple nodes.

What are the two node roles in a Docker Swarm?

Manager nodes (maintain cluster state, schedule tasks, and handle orchestration via the Raft consensus algorithm) and worker nodes (execute the tasks/containers assigned by managers). A node can be both.

In Swarm, what is the relationship between a service, a task, and a container?

A service is the definition of the desired state (image, replicas). The service is divided into tasks, and each task is the scheduling slot that runs exactly one container. Replicas = number of tasks/containers.

How does Swarm achieve high availability of the cluster state?

Manager nodes use the Raft consensus algorithm to replicate cluster state. A majority (quorum) of managers must be available; to tolerate $f$ manager failures you need $2f+1$ managers.

Name three Docker security best practices.

Run containers as a non-root user, use minimal/official trusted base images and scan them for vulnerabilities, drop unneeded Linux capabilities, keep images updated, use read-only filesystems, and never bake secrets into images (use Docker secrets).

Why should containers avoid running as root, and how do you change the user?

Running as root increases the blast radius if the container is compromised, since the container root can map to host root in some configs. Use the USER instruction in the Dockerfile (or --user at runtime) to run as a non-root, least-privilege user.

What are Docker secrets and namespaces' role in security?

Docker secrets securely store and deliver sensitive data (passwords, keys) to swarm services without embedding them in images or env vars. Namespaces isolate each container's processes/network/users, and user namespaces can remap container root to an unprivileged host user.

How do you view a container's logs and what is the default logging driver?

docker logs <container> (add -f to follow). The default logging driver is json-file, which writes stdout/stderr to JSON files on the host; other drivers include local, syslog, journald, fluentd, and awslogs.

What command shows a live stream of container resource usage statistics?

docker stats — it displays a live view of CPU %, memory usage/limit, network I/O, and block I/O for running containers. docker top shows the processes running inside a container.

What is a common stack for monitoring and logging Dockerized applications?

For metrics, Prometheus + cAdvisor + Grafana (collection, container metrics, dashboards). For centralized logs, the ELK/Elastic Stack (Elasticsearch, Logstash, Kibana) or EFK (with Fluentd).

How does Docker fit into a CI/CD pipeline?

CI builds a Docker image from the committed code, runs tests inside containers for consistent environments, then pushes the tagged image to a registry; CD pulls that immutable image and deploys it to staging/production, ensuring identical artifacts across stages.

Why are Docker images well-suited as CI/CD deployment artifacts?

Images are immutable, versioned (by tag/digest), and self-contained, so the exact artifact tested in CI is the one deployed — eliminating environment drift and enabling reliable rollbacks by redeploying a previous tag.

What is container orchestration and why is it needed?

Orchestration automates the deployment, scaling, networking, load balancing, health management, and lifecycle of containers across a cluster of machines. It is needed because manually managing many containers across many hosts is impractical.

What is Kubernetes and how does it relate to Docker?

Kubernetes (K8s) is an open-source container orchestration platform for automating deployment, scaling, and management of containerized applications. It runs Docker-built (OCI) container images across a cluster and is more feature-rich than Docker Swarm.

What is a Pod in Kubernetes?

A Pod is the smallest deployable unit in Kubernetes — one or more tightly coupled containers that share the same network namespace (IP/port space) and storage volumes, and are always scheduled together on the same node.

Compare Docker Swarm and Kubernetes.

Swarm is simpler, integrated with Docker, and easy to set up but has fewer features. Kubernetes is more complex with a steeper learning curve but offers richer features (auto-scaling, self-healing, large ecosystem) and is the industry-standard for large-scale orchestration.

What is a Kubernetes Deployment and a Service?

A Deployment declares the desired state for a set of replica Pods and manages rolling updates and self-healing. A Service provides a stable network endpoint (and load balancing) to access a dynamic set of Pods, since Pod IPs change.