Reading a Dockerfile and Using Docker Images

What it is

A Dockerfile is a text file of instructions that tells Docker how to build an image for an application.

An image is a read only template that holds the application, its libraries and its settings. A container is a running instance of an image.

On a developer machine you build an image from the Dockerfile, then start containers from it to test the application.

How it works

Each Dockerfile instruction adds a step, and Docker turns the steps into layers of an image.

A sample Dockerfile

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 5000
ENV APP_ENV=production
CMD ["python", "app.py"]

Reading the instructions

Reading the sample from top to bottom:

1. Start from a small Python image.
2. Work in the /app folder.
3. Copy the requirements list and install the packages.
4. Copy the rest of the code.
5. Note that the app listens on port 5000.
6. Set an environment variable.
7. Run python app.py when the container starts.

The requirements file is copied first on purpose. Docker caches each layer, so the install step is reused if only the code changed.

EXPOSE does not publish the port. You publish it when you run the container.

Building an image

$ docker build -t myapp:1.0 .

The -t option gives the image a name and a tag. The dot at the end says that the build context is the current folder. A .dockerignore file lists files to leave out, such as local secrets.

Listing and removing images

$ docker images
$ docker pull python:3.12-slim
$ docker rmi myapp:1.0

docker images lists the images on your machine. docker pull downloads an image from a registry, such as Docker Hub. docker rmi removes an image.

Running a container

$ docker run -d --name web -p 8080:5000 myapp:1.0

With this mapping, a browser on the host reaches the application on port 8080. The left number is the host port, and the right number is the container port.

Managing containers

$ docker ps
$ docker ps -a
$ docker logs web
$ docker exec -it web sh
$ docker stop web
$ docker rm web

docker ps shows running containers, and docker ps -a shows stopped ones as well. docker logs prints the output of the container.

docker exec -it opens an interactive shell inside it. Docker refuses to remove a running container unless you force it, so stop it first.

Sharing an image

To share an image, tag it with a registry name and push it.

$ docker tag myapp:1.0 REGISTRY/myapp:1.0
$ docker push REGISTRY/myapp:1.0

Other developers and the CI pipeline then pull the same image, so everyone runs the identical environment.

Containers are disposable

The writable layer of a container disappears when the container is removed. Keep data that matters in a volume or an external database, and rebuild the image to change the code.