Docker for beginners: images, containers and a first deployment
Docker for beginners: images vs containers, a 5-line Dockerfile for a Python app, key commands, ports, volumes and Compose, taken from Docker's own docs.
Docker is an open platform that packages an application with everything it needs into an image, which runs as an isolated process called a container. An image is immutable, a container is a process started from an image, and a Dockerfile is the text file that builds the image. A first deployment takes six steps: write the app, write a Dockerfile, build, run, call the app, then stop the container.
What problem does Docker solve, and is it a virtual machine?
Docker's documentation describes the platform as open for developing, shipping and running applications, and says containers are lightweight and contain everything needed to run the application, so there is no reliance on what is installed on the host. Take a hypothetical student whose project works on one laptop and fails on a friend's laptop because the Python version differs. A container carries the interpreter and libraries with the app, so both laptops run the same thing.
A container is not a virtual machine. Docker explains that a VM is an entire operating system with its own kernel, hardware drivers, programs and applications, while a container is an isolated process with the files it needs, and all containers on a host share the same kernel. The two are often combined: a cloud VM with a container runtime can run several containerised applications.
Docker also has two parts that matter on the command line. The Docker client talks to the Docker daemon, which builds, runs and distributes containers, so the daemon has to be running before any command works.
What is the difference between a Docker image and a container?
An image is the package and a container is the running result. A container image is a standardised package that includes the files, binaries, libraries and configuration needed to run a container. Images are immutable, so changing one means making a new image, and they are built from layers, each holding a set of file system changes.
A container is started from an image and is meant to be disposable. Each container can create, modify and delete files, and Docker says that when the container is deleted those changes are deleted too. The table sets the four basic terms side by side.
| Term | What it is | How it is made or used |
|---|---|---|
| Dockerfile | A text document with the commands used to assemble an image | Written by the developer |
| Image | An immutable, layered package of everything the app needs | Built from a Dockerfile, or pulled from a registry |
| Container | An isolated process started from an image | Started with docker run |
| Registry | A central place to store and share images, public or private | Docker Hub is the default public registry |
How do you build and run a first container?
The example is a small Python web server that uses only the standard library, so there is nothing to install. The steps are numbered.
- Create
app.py, which answers every GET request with JSON.
import json
from http.server import BaseHTTPRequestHandler, HTTPServer
class Hello(BaseHTTPRequestHandler):
def do_GET(self):
body = json.dumps({"message": "hello from a container", "path": self.path}).encode()
self.send_response(200)
self.send_header("Content-Type", "application/json")
self.end_headers()
self.wfile.write(body)
HTTPServer(("0.0.0.0", 8000), Hello).serve_forever()- Create a file named
Dockerfilenext to it.
FROM python:3.12-slim
WORKDIR /app
COPY app.py .
EXPOSE 8000
CMD ["python", "app.py"]Each line is an instruction from the Dockerfile reference. FROM creates a build stage from a base image, here the Docker Official Image for Python in its slim variant, and image tags are updated over time. WORKDIR sets the working directory for the instructions that follow and creates it if it does not exist. COPY copies files into the image. EXPOSE records that the container listens on port 8000. CMD sets the command that runs when a container starts.
- Build the image and name it with a tag.
docker build -t hello-api .- Run a container from the image in the background, publish the port and give the container a name.
docker run -d -p 8000:8000 --name hello hello-api- Call the app from the host.
curl http://localhost:8000/helloThe container's CMD runs the same python app.py command as a local run. Started locally with python3 app.py, the app answered that request with this JSON:
{"message": "hello from a container", "path": "/hello"}- Look at the container, read its logs, then stop and remove it.
docker ps
docker logs hello
docker stop hello
docker rm helloWhich Docker commands should a beginner know?
Docker's CLI reference describes each command in a line, and the table lists the ones used in a first project.
| Command | What it does |
|---|---|
| docker build -t hello-api . | Builds an image from the Dockerfile in the current folder; the tag has the form repository:tag |
| docker images | Lists images |
| docker run -d -p 8000:8000 --name hello hello-api | Starts a container; -d runs it in the background, -p publishes a port, --name names it |
| docker ps | Lists running containers; docker ps -a lists all of them |
| docker logs hello | Fetches the logs of a container |
| docker exec hello ls /app | Runs a command inside a running container |
| docker stop hello | Sends SIGTERM to the main process and, after a grace period, SIGKILL |
| docker rm hello | Removes a container |
| docker pull python:3.12-slim | Downloads an image from a registry |
| docker push name:tag | Uploads an image to a registry |
The --rm flag on docker run removes the container automatically when it exits, which keeps stopped containers from piling up.
How do ports and volumes work?
A container's network is isolated, so a port has to be published to reach it from the host. The flag -p HOST_PORT:CONTAINER_PORT forwards traffic from a host port to a container port, so -p 8080:80 sends traffic on host port 8080 to port 80 inside the container. EXPOSE in a Dockerfile does not publish anything. It functions as documentation about which ports are meant to be published, and the -p flag on docker run does the publishing.
By default a published port listens on all host interfaces, which Docker's documentation marks as something to be careful about for databases and other sensitive services. The form -p 127.0.0.1:8000:8000 keeps the port reachable only from the local machine.
Files written inside a container disappear when the container is deleted. A volume is Docker's answer: volumes are the preferred mechanism for persisting data used by containers, and they are managed by Docker, while bind mounts depend on the host's directory structure. The syntax is docker run --volume <volume-name>:<mount-path>, with -v as the short flag, and Docker's volumes page says the more explicit --mount flag is generally preferred.
What comes next: Compose, registries and Kubernetes?
Docker Compose describes several containers in one YAML file named compose.yaml, where each service lists its image or build, ports, volumes and networks. For the app above, the file is five lines.
services:
web:
build: .
ports:
- "8000:8000"The command docker compose up -d --build builds and starts the services in the background, and docker compose down stops and removes the containers and networks. Adding --volumes to down removes the volumes as well.
A registry is where images go to be shared. Docker Hub is the default public registry, and a registry holds repositories, each a collection of related images. Amazon, Microsoft and Google each run container registries of their own, and the three clouds are compared in AWS, Azure and Google Cloud for beginners.
Kubernetes sits one level above. It is a portable, extensible, open source platform for managing containerised workloads and services, which Google open sourced in 2014, and it handles scaling and failover, for example starting another container when one goes down. A beginner does not need it for a first deployment. A backend behind a mobile app, such as the apps compared in Flutter vs React Native vs native, can be packaged the same way.
What are the common mistakes and limits?
Most beginner problems come from a few misunderstandings.
- Treating EXPOSE as publishing. EXPOSE documents a port, and only -p on docker run publishes it.
- Confusing RUN and CMD. RUN executes a command at build time and commits the result as a layer, while CMD only sets the command for a running container, and only the last CMD in a Dockerfile takes effect.
- Expecting data to survive. Changes inside a container are deleted with the container, so databases need a volume.
- Ordering instructions carelessly. Each instruction is a layer, and when a layer changes every layer after it is rebuilt, so instructions that change least belong first.
- Publishing a database to every interface. The default listens on all host interfaces.
The limits are worth knowing too. Docker calls a container a loosely isolated environment, and containers share the host's kernel, unlike a VM. Docker is also not required to deploy an app. A static site can be published with GitHub Pages without any container, and Docker is one packaging choice among several.
In the Stack Overflow Developer Survey 2026, Docker and Docker Compose were used by 59.1% of the 10,889 respondents who answered the cloud and infrastructure question, which makes it the most used tool in that list. The survey is a global sample of developers, not a measure of hiring.
Where does the programme fit?
The Certification in Artificial Intelligence and Machine Learning is an online programme from Vishlesan i-Hub, IIT Patna, delivered on Masai's online platform, that covers Python, machine learning, deep learning, generative AI and LLMs, agentic systems and deploying models to production. Its curriculum lists containerised cloud deployment and REST APIs for models, which is where a Dockerfile like the one above is used to package a model service.
Frequently asked questions
What is the difference between a Docker image and a container?
A Docker image is an immutable, layered package of the files, libraries and configuration an app needs. A container is an isolated process started from that image. Many containers can start from one image, and changes made inside a container are deleted with the container.
Is Docker the same as a virtual machine?
No. A virtual machine is a whole operating system with its own kernel. A container is an isolated process with the files it needs, and all containers on a host share the same kernel. Docker notes that cloud setups often combine both, running containers inside VMs.
Do I need Docker to deploy an app?
No. Docker is one way to package an app so it runs the same everywhere. A static website can be published from a repository with GitHub Pages and needs no container. A server-side app can run on a host that supports its language directly, although a container removes the reliance on what is installed on the host.
What is a Dockerfile?
A Dockerfile is a text document containing the commands a person could run on the command line to assemble an image. Its instructions include FROM for the base image, WORKDIR for the working directory, COPY for files, RUN for build commands, EXPOSE for documenting ports and CMD for the default command.
What does docker compose do?
Docker Compose defines all the containers of an application and their settings in one YAML file named compose.yaml. The command docker compose up creates and starts the services, and docker compose down stops and removes the containers and networks, so anyone who clones the repository can start the stack with one command.
What is Kubernetes, and do beginners need it?
Kubernetes is an open source platform for managing containerised workloads, including scaling and failover. A beginner does not need it to run a first container. Docker, a Dockerfile and docker run are enough to learn images and containers, and Kubernetes becomes relevant when many containers must run across several machines.
Next step
A Dockerfile is one way to turn a working model or API into a service that runs the same elsewhere. Learners who want to go from Python and machine learning to deploying models can read about the Certification in Artificial Intelligence and Machine Learning.