6.2Managing Docker Containers and Images

The namespaces, cgroups, and image mechanics from the previous section become day-to-day work through the Docker tool. Being able to precisely choose commands to start, pause, stop, and remove containers, and to pull, build, and distribute images, matters both in practice and on the exam.

6.2.1Networking and inspecting state

• Port mapping associates a container's internal port with a host port (e.g., docker run -p 8080:80, host:container). It lets multiple containers on a single host IP be exposed externally.
• The flat L2 network model connects containers to the same virtual L2 network (a single subnet) through a bridge, letting them reach each other directly without routing—the default networking shape.
• docker ps lists running containers (-a includes stopped ones too). docker stats shows live CPU, memory, and network I/O usage for running containers.

6.2.2Container lifecycle management

• docker run creates a new container from an image and starts it immediately (pulling from the registry first if the image is not local). docker create creates a container without starting it (for a later docker start). docker restart restarts a running or stopped container.
• docker pause freezes all processes in a container (via the cgroups freezer) so they stop using CPU. docker unpause thaws them and resumes execution. Unlike stopping, process state is preserved while frozen.
• docker stop sends a termination signal, then stops after a grace period (attempting a clean shutdown). docker kill terminates immediately with no grace period. docker rm removes a stopped container (a running one needs -f, or must be stopped/killed first).

For working directly inside a container, choose between docker attach and docker exec. attach connects to the standard I/O of the already-running main process (PID 1)—useful for watching logs or sending input directly to that process. But be careful: sending Ctrl+C while attached can terminate the main process itself and stop the container. exec, by contrast, starts a new process inside the running container, and is the right tool for opening an extra debugging shell, e.g. docker exec -it container_name /bin/bash—it does not touch the original main process. Images are obtained from a Docker registry (Docker Hub by default). docker pull fetches an image from the registry; docker images locally lists held images (repository, tag, image ID, size); docker rmi removes ones no longer needed. docker import creates a new single-layer image with no layer history from a tar-format filesystem archive. The main way to build images is the Dockerfile: a text file listing instructions such as FROM, RUN, COPY, and CMD, which docker build executes reproducibly in order (each instruction roughly becomes one layer). docker commit, in contrast, snapshots the current state of an already-running (and modified) container directly into an image—it leaves no Dockerfile recipe, so it is less reproducible, but it is handy for quickly capturing a present state.

6.2.3Section summary

• Lifecycle = run (create+start) / create (create only) / restart, stop (graceful) / kill (immediate) / rm (remove), pause/unpause (freeze/thaw)
• Images = pull from registry / list with images / remove with rmi / import for a single-layer image. Build with Dockerfile + build (reproducible) or commit (snapshot a running state directly)