Docker & Containers — DevOps

Before containers: "it works on my machine" was the most common excuse in software. Containers end this by bundling the app, its runtime, and config into one portable unit that runs identically on any host. Same image, any environment.

Container Isolation in 3D

Three containers on a shared host machine. Press Run Containers to start them, then Isolate Network to see namespace boundaries.

drag — scroll to zoom

Code example

A multi-stage Dockerfile and a docker-compose setup for local development.

DOCKER — BUILD & RUN

# Multi-stage build — final image has no build tools
FROM node:20-alpine AS builder
WORKDIR /app

# Copy dependency files first — layer cache means npm ci
# only re-runs when package.json changes, not every source change
COPY package*.json ./
RUN npm ci --only=production

COPY . .
RUN npm run build

# ---- Production image ----
FROM node:20-alpine AS production
WORKDIR /app

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules

# Run as non-root user (security best practice)
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

EXPOSE 3000
CMD ["node", "dist/server.js"]
# docker-compose.yml — local dev environment
services:
  api:
    build: .
    ports:
      - "3000:3000"
    environment:
      DATABASE_URL: postgres://user:pass@db:5432/myapp
      NODE_ENV: development
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./src:/app/src   # hot reload in dev

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: myapp
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user"]
      interval: 5s
      timeout: 3s
      retries: 5

  redis:
    image: redis:7-alpine
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru

volumes:
  pg_data:
      

Key concepts

📦

Docker Image

layers — read-only — blueprint

A layered, immutable snapshot built from a Dockerfile. Each instruction (FROM, RUN, COPY) creates a new layer. Layers are cached and shared — efficient storage and fast builds.

🐳

Container

process — isolated — ephemeral

A running instance of an image with its own filesystem, network, and PID namespace — but sharing the host kernel. Containers are disposable: kill and recreate freely.

📄

Dockerfile

build — instructions — reproducible

A text file of instructions: FROM sets the base image, RUN executes commands, COPY adds files, CMD sets the default command. The recipe that makes any build reproducible.

🔒

Namespace Isolation

kernel — cgroups — security

Linux namespaces give each container a private view: its own network interfaces, mount points, and process IDs. cgroups limit CPU and memory. Same isolation as VMs, a fraction of the overhead.

→ CI/CD Pipelines DevOps — Algo3DVerse Kubernetes ?