System Information and Access Configuration

Verify the environment setup and retrieve engine details using foundational commands:

docker system ver
docker system info
docker <command> --help

To operate Docker without root privileges, add the target user to the docker group and refresh the session:

sudo usermod -aG docker admin_user
newgrp docker

Validate the non-root configuration by executing a test container:

docker run alpine echo "Access confirmed"

Linux Filesystem Anatomy in Containers

When accessing a container shell, the directory structure resembles a standard Linux layout:

• /bin: Core user binaries and shell executables.
• /boot: Bootloader and kernel initialization files.
• /dev: Hardware device interfaces and special files.
• /etc: Host and service configuration files.
• /home: User-specific data directories.
• /lib, /lib32, /lib64: Shared system libraries required by binaries.
• /media, /mnt: Mount points for removable and temporary filesystems.
• /opt: Optional third-party software installations.
• /proc: Virtual filesystem exposing kernel and process metrics.
• /root: Administrative super-user home directory.
• /run: Transient runtime data and socket files.
• /sbin: System administration executables.
• /srv: Data payloads served by system protocols (HTTP, FTP).
• /sys: Virtual filesystem for hardware and kernel module interactions.
• /tmp: Ephemeral temporary storage.
• /usr: User utilities, applications, and documentation.
• /var: Variable data including logs, caches, and spool files.

Image Lifecycle Management

List all local image repositories and their identifiers:

docker image ls --all

Query remote registries for specific software distributions:

docker search postgres --filter stars=500

Retrieve an image with its specific release tag; omitting the tag defaults to the latest release. The download process applies an overlay filesystem, fetching independent layers:

docker pull postgres:14

Remove unwanted images by targeting their repository ID or forcefully purging the entire local inventory:

docker rmi -f <image_id>
docker rmi $(docker image ls -q)

Archive an image to a tarball for offline distribution, and subsequently reload it:

docker save -o nginx_backup.tar nginx:alpine
docker load -i nginx_backup.tar

Container Execution and Control

Instantiate a container from an image with interactive terminal access and custom naming:

docker run --name my_alpine -it alpine /bin/sh

Detach from an interactive session without halting the process using Ctrl+P+Q. Terminate and exit the session entirely with the exit command.

Enumerate active or historically executed containers:

docker container ls
docker container ls --all

Manage container lifecycle states:

docker start <id>
docker restart <id>
docker stop <id>
docker kill <id>

Destroy halted containers or aggressively remove all instances:

docker rm <id>
docker container prune -f

Networking and Container Specifics

Docker establishes an isolated bridge network (docker0) distinct from the host's primary interface (e.g., ens33). The bridge operates on the 172.17.0.0/16 subnet, assigning dynamic IPs to spawned containers. This segregation enables secure inter-container and host-to-container routing.

To establish SSH connectivity with a container, an SSH daemon must be installed inside the image, and the port must be mapped to the host:

docker run -p 2222:22 -d ssh_enabled_image
ssh admin_user@172.17.0.x -p 2222

Container environments typically lack systemd. Service management relies on direct command invocation rather than systemctl:

service sshd start

Advanced Container Operations

Daemonized containers require a persistent foreground process; otherwise, the engine terminates the instance immediately:

docker run -d alpine sleep infinity

Inspect real-time standard output and error streams from a container:

docker logs -ft --tail 20 <id>

Monitor active process entities within an instance:

docker top <id>

Extract comprehensive metadata and network bindings of an instance:

docker inspect <id>

Attach to a running process's standard input without creating a new shell:

docker attach <id>

Execute an independent shell session within a live container:

docker exec -it <id> /bin/sh

Transfer files between the host filesystem and an active container:

docker cp local_file.txt <id>:/app/
docker cp <id>:/app/config.yaml ./

Practical Service Deployments

Reverse Proxy Deployment

Launch an HTTP server with host-to-container port forwarding:

docker run -d --name web_proxy -p 8080:80 nginx:stable
curl http://localhost:8080

Access the configuration directory inside the proxy instance:

docker exec -it web_proxy /bin/sh
cd /etc/nginx

Application Server Deployment

Instantiate a Java web server, noting that certain minimal images omit default deployment directories:

docker run -d --name app_server -p 8888:8080 tomcat:jdk11
docker exec -it app_server /bin/sh

Search Engine Deployment

Launch Elasticsearch while enforcing strict memory boundaries to prevent host resource exhaustion:

docker run -d --name es_node -p 9200:9200 -p 9300:9300 
  -e "discovery.type=single-node" 
  -e ES_JAVA_OPTS="-Xms128m -Xmx512m" 
  elasticsearch:7.6.2

Verify cluster responsiveness and monitor resource utilization:

curl http://localhost:9200
docker stats

Graphical Management Interface

Deploy Portainer to administer the local Docker environment via a web dashboard:

docker run -d -p 9001:9000 --restart=always 
  -v /var/run/docker.sock:/var/run/docker.sock 
  --privileged=true portainer/portainer-ce