ELI5: Docker containers

I would highly recommend using docker compose files. The services you are after usually have them in their installation instructions, on github or docker hub (the latter tells you how many image pulls so you can see what most people are using). Also check out https://awesome-docker-compose.com/apps and https://haxxnet.github.io/Compose-Examples/.

Then think of each compose file as a separate service that functions completely independently and can't access any others unless you open a port to the host system (ports: ) or have a common network (networks:). The container cannot access or save files unless you open volumes (volumes: ). Personally I have separate folders for each service, and always persist and store config, data and db files in a subfolder of that so it's all in one place. It's easier to migrate or save your info if something goes wrong, and males backups easier to manage.

In the composer file there is image: <image place/image>:

<tag>

To update a docker compose file, go to the folder, update the version of the image (e.g :15.6 to :16.1) or if using the 'latest' tag no need to change anything. Then run "docker compose down && docker compose pull && docker compose up -d" to update the services top the latest image.

I use wud https://github.com/getwud/wud about once a week to highlight any available updates then manually update them one by one, and before doing so looking at the update notes to see if there are any breaking changes and testing the services after. I used to just use latest and blindly update but have had occasional issues like bad updates or having to figure out breaking changes. If it goes wrong you can just go back to the old version while you investigate more.

Also, docker keeps old images forever unless you prune them so lookup 'docker image prune' or 'docker system prune' before trying them as they'll remove a lot.

Docker is essentially a security construct.

The idea is that the process inside the container, like say MySQL, Python or Django, runs as a process on your machine in such a way that it can only access parts of the system and the world that it's explicitly been granted access to.

If you naively attempted this, you'd run into a big problem immediately. Namely that a program needs access to libraries. So you need to grant access to those. Libraries might be specific to the program, or they might be system libraries like libc.

One way is to explicitly enumerate each required library, but then you'd need to install those for each such process, which is inconvenient and a security nightmare.

Instead you package the libraries and the program together in a package called a Docker image.

To simplfy things, at some point it's simpler to start with a minimal set of known files, like say Alpine, Debian, or Fedora.

This basically means that you're downloading a bunch of stuff to make the program run and thus is born the typical Docker image. If you look at the Python image, you'd see that it's based on some other image. Similarly, a Django image is based on a Python image. It's the FROM line in a Dockerfile.

A container is such an image actually running the isolated process, again, like say MySQL.

Adding information to that process happens in a controlled way.

You can use an API that the process uses, like say a MySQL client. You can also choose to include the data in the original image, or you can use a designated directory structure that's visible to both you and the process, this is called a volume.

To run something like a Django application would require that Python has access to the files, which can be included in the image by using a custom Dockerfile, or it can be accessed y the container whilst it's running, using a volume.

It gets more interesting when you have two programs needing access to the same files, like say nginx and python. You can create shared volumes to deal with this.

Ultimately, Docker is about security and making it convenient to implement and use.

Source: I use Docker every day.