Architectural Overview

In conatinerization, an image functions as an immutable blueprint, analogous to a compiled class definition in object-oriented languaegs. A container represents an active, isolated runtime instance derived from that blueprint. Grasping this relationship is essential for orchestrating reproducible application environments.

Daemon Service Control

The Docker engine operates as a background system service. Standard process managers handle its lifecycle and boot configuration:

# Initialize the engine
sudo systemctl start docker

# Halt the engine
sudo systemctl stop docker

# Reload configuration and restart
sudo systemctl restart docker

# Enable automatic startup on host boot
sudo systemctl enable docker

# Verify operational state and active units
sudo systemctl status docker

# Inspect client and server version matrices
docker version
docker info

Registry & Image Operations

Images are retrieved, cataloged, and refactored through dedicated registry commands. Explicit version tags ensure build consistency across environments.

# List locally cached images
docker images

# Query public registry filtered by popularity
docker search --filter=STARS=5000 redis

# Fetch a specific release
docker pull redis:7.2-alpine

# Generate a custom reference for environment tracking
docker tag redis:7.2-alpine internal-cache:dev-v1.0

# Export to a portable archive
docker save internal-cache:dev-v1.0 -o /opt/backups/cache-image.tar

# Import an archived image back into the local store
docker load -i /opt/backups/cache-image.tar

# Remove unused layers (supports partial ID matching)
docker rmi -f internal-cache:dev-v1.0
docker rmi -f $(docker images -aq)

Container Initialization & Execution

Launching a container transforms a static image into a running process. Flags control interactivity, background execution, and naming conventions.

# Start an interactive, detached session with a custom alias
docker run -it -d --name web-server-alpha nginx:stable /bin/bash

# Verify active processes
docker ps
docker ps -a  # Includes terminated instances

# Inject a shell process into a running container
docker exec -it web-server-alpha /bin/sh

# Attach to the primary standard I/O stream (legacy approach)
docker attach web-server-alpha

Exiting a session requires careful handling to avoid unintended termination:

# Immediate exit; terminates the container if launched without -d
exit

# Graceful detachment; preserves container state regardless of launch flags
Ctrl + P, then Ctrl + Q

State Transition Commands

Containers follow a strict lifecycle. State changes are managed explicitly through dedicated subcommands:

docker stop container-alias
docker restart container-alias
docker start container-alias
docker kill container-alias  # Sends SIGKILL immediately

Network Isolation & Port Binding

Containers operate within isolated network namespaces. Internal ports are inaccessible from the host until explicitly mapped. Binding creates a bridge between the host's network stack and the container's virtual interface.

# Map host port 9090 to internal port 8080
docker run -d --name app-node-01 -p 9090:8080 my-app:latest

# Verify host-level listener
ss -tlnp | grep 9090

Note: Host ports are unique system-wide. Once bound, the same host port cannot be reassigned to another container.

Filesystem Synchronization & Persistence

Container filesystems are ephemeral. Data survives beyond container lifecycles only when persisted via bind mounts or named volumes.

# Bind mount: Host directory linked to container path
docker run -d --name db-service -v /data/postgres:/var/lib/postgresql/data postgres:15

# Copy artifacts across boundary (works on stopped or running instances)
docker cp ./config.yaml db-service:/etc/config/
docker cp db-service:/var/log/app.log ./audit/

Named volumes are managed directly through the Docker volume subsystem:

docker volume create app-storage
docker volume ls
docker volume inspect app-storage

Update restart policies dynamically without recreating the container:

docker update --restart=always db-service

Logging & Diagnostics

Standard output and error streams are captured by the daemon. Tail logs for real-time debugging:

docker logs --tail=50 -f db-service

Image Customization & System Maintenance

When a running container requires permanent configuration changes, commit it to generate a new base image:

docker commit -m "Added custom SSL certificates" -a "DevOps Team" db-service internal-db:secure-v2

Monitor storage consumption and clean up orphaned resources:

# Identify daemon storage location
docker info | grep "Docker Root Dir"

# Analyze disk allocation
docker system df

# Purge dangling images, stopped containers, and unused networks
docker system prune -a

# Locate oversized artifacts on the host
find /var/lib/docker -type f -size +200M -exec du -h {} + | sort -hr

Migrate the daemon data directory if disk space constraints arise:

systemctl stop docker
mkdir -p /mnt/docker-data
rsync -avz /var/lib/docker/ /mnt/docker-data/
# Update daemon.json to point to /mnt/docker-data, then restart service