11–20 of 27 posts
I think Docker has a fairly well designed CLI and I don't find myself having to Google commands for it often. It follows a few pretty consistent patterns that I wish git had tried to stick with rather than the concoction of words and flags for common actions it ended up with.
I would like to know what the difference is between a stopped container and an image.
Please add - Security warnings: like: Note that ports which are not bound to the host (i.e., -p 5432:5432 instead of -p 127.0.0.1:5432:5432) will be accessible from the outside. This also applies if you configured UFW to block this specific port, as Docker manages its own iptables rules. https://docs.docker.com/network/packet-filtering-firewalls/ - using trivy scanner: "trivy image --ignore-unfixed ... " ------------…
Author here. This is actually a good point, we will add this in the near future. Thanks for your input.
In general, I think it's also a good general idea to keep yourself to one, maximum two RUN statements per image - I've seen it way too many times that some junior writes RUN apt update, RUN apt install -yf foo, RUN apt clean... which will leave all the intermediate crap from apt still part of the final image as the third command (the apt clean) will just set tombstone files [1][2] in the layer's overlay image.
(Side note, it boggles my mind why you can't tell Docker to flatten multiple subsequent "metadata only" layers like LABEL/ENV/CMD/ENTRYPOINT/ARG into one single one)
Additionally, I'd add a warning for multi-stage builds that ARG needs to be redeclared in following stages (a simple ARG xyz is sufficient, no need to repeat a default value), and that CMD/ENTRYPOINT set in the first stage for some reason tend to be overwritten in a stage that is FROM first-stage.
[1] https://github.com/aws-samples/linux-container-primitives-pr...
[2] https://jvns.ca/blog/2019/11/18/how-containers-work--overlay...
> What Is The Difference Between A Dockerfile, An Image And A Container? I would like to know what the difference is between a stopped container and an image.
> What Is The Difference Between A Dockerfile, An Image And A Container? I would like to know what the difference is between a stopped container and an image.
So a stopped container could have stuff in it that doesn't exist in the image, as the container has gone through the states of "created > running > stopped" and during the running, you can mutate stuff in the container.
On the other hand, an image never actually runs, only containers created from that image.
I guess you could compare it to VMs as well, where you can have templates/other instances, and clone new instances from that template/other instance. Kind of the same too.
The purpose of the dockerfile and the ALL CAPS convention always reminds me of old JCL. https://en.wikipedia.org/wiki/Job_Control_Language
The purpose of the dockerfile and the ALL CAPS convention always reminds me of old JCL. https://en.wikipedia.org/wiki/Job_Control_Language