Docker

Docker is a client-server platform that builds, ships, and runs applications inside isolated Linux (or Windows) processes called containers, using OS-level virtualization instead of full hardware virt

A Docker image is a read-only, layered filesystem template plus metadata (entrypoint, env vars, exposed ports, etc.). A container is a running (or stopped) instance of an image: the image's layers mou

A Dockerfile is a declarative, line-by-line recipe for building an image. Each instruction either creates a new layer (FROM, RUN, COPY, ADD) or sets image metadata that doesn't add a filesystem layer

Container filesystems are ephemeral by design — the writable layer disappears with the container. Docker provides three mechanisms for data that needs to outlive a container or be shared with the host

Docker networking is implemented by libnetwork using a pluggable driver model. The four drivers you must know cold for interviews are: bridge (default, single-host container-to-container networking),

Docker Compose is a declarative tool for defining and running multi-container applications from a single YAML file (compose.yaml). It is the standard local-development and small-deployment tool for an

Container security is layered defense-in-depth: who the process runs as inside the container (non-root), how secrets reach the container without being baked into the image or visible in plain env vars

Observability for containerized applications rests on three pillars: logs (discrete event records), metrics (numeric time-series data — request counts, latencies, resource usage), and traces (request

This chapter applies everything from Chapters 1-8 to the stack most readers actually run day to day: a Spring Boot service backed by PostgreSQL, Redis, and Kafka, deployed as containers and composed t

CI/CD pipelines automate the journey from source code commit to a running container in production: build the image, test it, scan it, push it to a registry, and deploy it. Docker is the packaging form

Kubernetes is a container orchestration platform: it schedules containers onto a cluster of machines, keeps the desired number of replicas running, handles networking and service discovery across node

This chapter consolidates and deepens the performance-related threads from earlier chapters (Chapter 2's layer caching, Chapter 3's multi-stage builds) into a single, interview-focused treatment, and

This chapter synthesizes everything from Chapters 1-12 into a single production-readiness lens. It does not introduce a new Docker feature; instead it answers the question every architect and senior e

A registry is the piece of Docker's architecture that turns a locally-built image into something every environment — CI, staging, production — can pull the exact same bytes of. This chapter is that distribution layer: Docker Hub, running your own private registry, and the tagging/versioning conventions that keep it usable at scale.

Every earlier chapter covered one container-level mechanism correctly in isolation. This chapter is the system-design layer above all of them — how containerized services actually get composed into an architecture, and the deployment-rollout strategies that decide how a new version reaches production traffic.