Managing Docker Images

To interact with Docker images, use the docker image command set. These commands allow you to inspect, build, transfer, and clean up container images efficiently.

• docker image ls or docker images: List all locally available images.
• docker image pull [IMAGE_NAME]: Download an image from a registry (e.g., docker pull mysql).
• docker image build: Create an image using a Dockerfile.
• docker image history [IMAGE]: Show layer-by-layer changes for a specific image (e.g., docker history mysql).
• docker image inspect [IMAGE]: Retrieve detailed metadata about an image including architecture, author, and configuration.
• docker image tag [SOURCE] [TARGET]: Assign a new name or namespace to an existing image. Useful when preparing images for push to private registries.
• docker image push: Upload a tagged image to a container registry. Requires proper tagging and login access.
• docker image save -o [FILE.tar] [IMAGE]: Archive one or more images into a tarball for backup or migration purposes. Supports multiple images in a single file.
• docker image load -i [FILE.tar]: Restore images from a saved tar archive. Preserves full image history and layers.
• docker image rm [IMAGE] or rmi: Remove unused images to free disk space.
• docker image prune: Automatically remove dangling images not referenced by any container.
• docker search [TERM]: Find public images on Docker Hub (e.g., docker search ubuntu).

Export vs Save: Key Differences

Example workflow:

# Export and re-import a modified container as image
docker container export -o myapp-container.tar my-running-app
docker import myapp-container.tar mybaseimage:v2

# Save and load full image(s) with history
docker image save -o app-stack.tar nginx redis myapp:latest
docker image load -i app-stack.tar

Working with Containers

Docker containers can be managed using the docker container subcommands or their shorthand equivalents.

• docker container create: Define a container without starting it.
• docker container run: Launch a new container from an image. Common flags:
  • -d: Run in detached mode.
  • -it: Enable interactive TTY session.
  • --name: Asign a custom name.
  • -p [HOST_PORT]:[CONTAINER_PORT]: Map ports.
  • --restart always: Auto-start container on system boot or daemon restart.
• docker ps: Display running containers.
  • -a: Include stopped containers.
  • -l: Show latest created container.
  • -q: Quiet mode — show only IDs.
• docker container start/stop/restart [ID|NAME]: Control container state.
• docker container kill [ID]: Force terminate a container immediately.
• docker container exec -it [ID] [COMMAND]: Execute commands inside a running container (e.g., /bin/bash).
• docker container logs [ID]: View stdout/stderr output. Use -f to follow log stream.
• docker container rm [ID]: Delete a stopped container. Add -f to force removal of running ones.
• docker container prune: Clean up all stopped containers.
• docker container cp [SRC] [DEST]: Copy files between host and container (e.g., docker cp myfile.txt container:/tmp).
• docker container inspect [ID]: Get detailed container configuration and network settings.
• docker container stats [ID]: Monitor real-time resource usage (CPU, memory, network). Use --no-stream for one-time output.
• docker container top [ID]: View processes currently running inside the container.
• docker container pause/unpause [ID]: Freeze/resume all processes within a container.

Create and manage a sample HTTP container:

docker run -d -it --name httpd-web -p 81:80 httpd
docker exec -it httpd-web /bin/bash
docker logs -f httpd-web

Committing Changes and Production Considerations

You can convert a running container into a new image using:

docker commit -m "Applied security updates" -a "Admin" [CONTAINER_ID] my-httpd:v1

Key production tips:

• Avoid overriding entrypoint CMDs unintentionally. For example, appending /bin/bash might prevent services like Nginx from launching unless explicitly started.
• Base OS containers (like CentOS) often require explicit shell invocation if no default command is defined.
• Set environment variables at runtime: docker run -e ENV_VAR=value .... View them inside with env or echo $ENV_VAR.
• Use --privileged=true cautiously for containers needing extended capabilities (not recommended in restrictive environments like Rocky Linux 9).
• Enable automatic restarts in production: --restart always ensures service continuity after reboots.

Daemon Configuration via daemon.json

The Docker daemon can be customized through /etc/docker/daemon.json. Example configuration:

{
  "debug": true,
  "data-root": "/var/lib/docker",
  "dns": ["192.168.1.1"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "registry-mirrors": ["https://registry.docker-cn.com"],
  "insecure-registries": [],
  "labels": ["nodeName=node-121"],
  "live-restore": true,
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ],
  "bip": "192.168.88.0/22",
  "iptables": false,
  "ip-forward": false
}

After modifying, reload with sudo systemctl reload docker.

Understanding iptables Basics

Docker uses iptables to manage networking and port mapping. It operates on five built-in chains across three main tables:

• Filter Table: Handles packet filtering.
  • INPUT — incoming packets to host
  • OUTPUT — locally generated packets
  • FORWARD — packets routed through the host (used by Docker bridge networks)
• NAT Table: Manages network address translation.
  • PREROUTING — modify packets before routing (e.g., DNAT)
  • POSTROUTING — modify packets after routing (e.g., SNAT, MASQUERADE)
• Mangle Table: Alters packet headers (rarely used directly by Docker).

Docker automatically inserts rules into these chains to enable container connectivity, port publishing, and DNS resolution.