Stage 4 · Provision

Container Fundamentals

Your First Container

Run hello-world and alpine with docker run, inspect metadata, execute shells, and remove containers.

6 min readDocker & ContainersProvision

hello-world

The hello-world image is Docker's smoke test. It verifies that your Docker installation is working and that the daemon can pull images and create containers. This is the first thing to run after installing Docker.

Run the hello-world container


docker run hello-world

# Output:
# Hello from Docker!
# This message shows that your installation appears to be working correctly.

Docker pulled the hello-world image (if not cached), created a container, ran it, printed the message, and exited. The container is then in a stopped state.

Interactive Alpine

Alpine Linux is a minimal distribution commonly used as a container base image. At about 7MB, it starts instantly and gives you a real Linux environment to explore.

Run an interactive Alpine container


# -it allocates a TTY and keeps STDIN open
# --rm removes the container when it exits
docker run -it --rm alpine sh

# Inside the container:
cat /etc/os-release
ls /
whoami
exit

The -it flags are essential for interactive sessions. -i keeps STDIN open, -t allocates a pseudo-TTY. Without them, your shell commands will not work interactively.

Understanding docker run

The docker run command is the most fundamental Docker operation. It combines docker create (which sets up the container) and docker start (which runs it). Understanding its options gives you full control over container behavior.

Common docker run options


# Detached (background) mode
docker run -d nginx

# Give the container a name
docker run -d --name webserver nginx

# Set environment variables
docker run -d -e POSTGRES_PASSWORD=secret postgres

# Publish a port
docker run -d -p 8080:80 nginx

# Limit resources
docker run -d --memory=256m --cpus=0.5 nginx

# Restart policy
docker run -d --restart=always nginx

These options configure the container before it starts. The image name comes last. Everything before the image name is a container configuration option.

Inspecting Containers

Once a container is running, Docker provides several commands to inspect its state, logs, and metadata. These tools are essential for debugging and monitoring.

Container inspection commands


# List running containers
docker ps

# List all containers (including stopped)
docker ps -a

# View container logs
docker logs webserver

# Inspect container metadata (JSON)
docker inspect webserver

# View resource usage
docker stats webserver --no-stream

# View running processes inside the container
docker top webserver

docker inspect returns detailed JSON about every aspect of a container: network settings, mounts, environment variables, state, and configuration. Use --format to extract specific fields.

Exec Into Containers

docker exec runs a new process inside a running container. This is invaluable for debugging — you can open a shell, check logs, inspect files, or run diagnostic commands without modifying the container's entrypoint.

Exec into a running container


# Start a container
docker run -d --name debug nginx

# Open an interactive shell inside it
docker exec -it debug sh

# Run a single command
docker exec debug cat /etc/nginx/nginx.conf

# Run as a specific user
docker exec -u root debug ls /etc/shadow

docker exec creates a new process inside the container's namespaces. It does not restart the container or affect the main process. The exec process is independent of the container's entrypoint.

Cleanup

Stopped containers and unused images consume disk space. Docker provides commands to remove containers, images, and unused resources. Regular cleanup prevents disk exhaustion.

Cleanup commands


# Stop a running container
docker stop webserver

# Remove a stopped container
docker rm webserver

# Stop and remove in one command
docker rm -f webserver

# Remove unused images
docker image prune

# Remove everything unused (images, containers, networks)
docker system prune

# Nuclear option — remove ALL images and containers
docker system prune -a --volumes

docker system prune is safe to run in development — it only removes unused resources. The -a flag removes all unused images, not just dangling ones. --volumes also removes unused volumes.

Use --rm for throwaway containers

When running containers for one-off tasks, add --rm to automatically remove the container when it exits. docker run --rm alpine echo hello cleans up after itself.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.