Docker architecture revolves around three primitives: images, containers, and registries. An image provides an immutable filesystem template that bundles application binaries, system libraries, and configuration metadata. A registry functions as a storage and distribution layer for these templates. A container represents an ephemeral, isolated runtime instance created from an image template.

To build an image, create a Dockerfile that declarative assembles the environment:

FROM golang:1.21-alpine AS builder
WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /build/api ./cmd/server

FROM gcr.io/distroless/static-debian12
WORKDIR /app
COPY --from=builder /build/api .
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/app/api"]

This multi-stage definition compiles a Go application in side an Alpine-based builder stage, then copies the compiled binary into a minimal distroless runtime. The final stage exposes port 8080 and launches the executable under a non-root user identity.

Once the image is built, launch a container with port forwarding and restart policies:

docker run -d --name go-api -p 9000:8080 --restart unless-stopped my-go-app:latest

This instantiates a detached container named go-api, maps host port 9000 to container port 8080, configures automatic restarts, and references the locally tagged image.

Registries enable image sharing across teams and environments. After authenticating to a private or public registry, publish the local artifact by assigning a remote path:

docker tag my-go-app:latest harbor.internal.io/backend/api:v2.1.0
docker push harbor.internal.io/backend/api:v2.1.0

The tag operation links the local image to a repository path and semantic version. The push operation uploads the layers to the registry, where other Docker hosts can retrieve the exact artifact:

docker pull harbor.internal.io/backend/api:v2.1.0

Pulling that sepcific version guarantees that every container spawned from it inherits identical filesystem contents and runtime behavior, regardless of the underlying host platform.