Docker flashcards: 50 essentials for developers

All 50 cards

1. 1
   Image vs container
   An image is a read-only template made of layers; a container is a running (or stopped) instance of an image with its own writable layer
2. 2
   What creates a new image layer?
   Instructions that change the filesystem, mainly RUN, COPY and ADD
3. 3
   When does Docker’s build cache stop being reused?
   At the first instruction whose inputs changed; every instruction after it is rebuilt
4. 4
   Order a Node.js Dockerfile so dependency installs stay cached
   dockerfile

   COPY package.json package-lock.json ./
   RUN npm ci
   COPY . .

   Copying the lockfile first means code changes don’t invalidate the npm ci layer.
5. 5
   What does FROM do?
   Sets the base image for the build stage; every Dockerfile starts with it (after optional ARGs)
6. 6
   COPY vs ADD
   COPY copies files from the build context; ADD can also fetch URLs and auto-extract local tar archives

   Prefer COPY unless you need those extras.
7. 7
   CMD vs ENTRYPOINT
   ENTRYPOINT sets the executable; CMD sets default arguments (or the default command) that docker run arguments replace
8. 8
   Exec form vs shell form
   Exec form (JSON array) runs the program directly as PID 1 so it receives signals; shell form wraps it in /bin/sh -c

   dockerfile

   CMD ["node", "server.js"]   # exec form
   CMD node server.js           # shell form

9. 9
   ARG vs ENV
   ARG exists only at build time; ENV is set at build time and persists into running containers
10. 10
    What does WORKDIR do?
    Sets (and creates if needed) the working directory for later instructions and for the container
11. 11
    Run the container as a non-root user
    dockerfile

    RUN useradd --create-home app
    USER app

    Official Node images already include a node user: USER node.
12. 12
    What does EXPOSE 3000 do?
    Documents the port the app listens on; it doesn’t publish it. Use -p at run time
13. 13
    Add a health check to an image
    dockerfile

    HEALTHCHECK --interval=30s --timeout=3s \
      CMD curl -fsS http://localhost:3000/health || exit 1

14. 14
    Multi-stage build
    Build in one stage and copy only the artifacts into a small final image

    dockerfile

    FROM node:22 AS build
    WORKDIR /app
    COPY . .
    RUN npm ci && npm run build
    
    FROM node:22-slim
    WORKDIR /app
    COPY --from=build /app/dist ./dist
    CMD ["node", "dist/server.js"]

15. 15
    What is .dockerignore for?
    Excludes files from the build context (like node_modules, .git, .env), making builds faster and images safer
16. 16
    What is the build context?
    The set of files sent to the builder, usually the directory passed to docker build (often .)
17. 17
    Build and tag an image
    bash

    docker build -t myapp:1.0 .

18. 18
    Run a container detached, named, with a published port
    bash

    docker run -d --name web -p 8080:80 nginx

19. 19
    In -p 8080:80, which port is the host’s?
    The first: host port 8080 maps to container port 80
20. 20
    Remove the container automatically when it exits
    bash

    docker run --rm alpine echo hi

21. 21
    Pass an environment variable or an env file
    bash

    docker run -e NODE_ENV=production --env-file .env myapp

22. 22
    Open a shell in a running container
    bash

    docker exec -it web sh

23. 23
    Follow a container’s logs
    bash

    docker logs -f web

24. 24
    List all containers, including stopped ones
    bash

    docker ps -a

25. 25
    Remove unused data (stopped containers, unused networks, dangling images, build cache)
    bash

    docker system prune

    Add -a to also remove all unused images, and --volumes for unused anonymous volumes.
26. 26
    Named volume vs bind mount
    A volume is managed by Docker and survives container removal; a bind mount maps a host path into the container
27. 27
    Mount a named volume for Postgres data
    bash

    docker run -v pgdata:/var/lib/postgresql/data postgres:17

28. 28
    Bind-mount the current directory read-only
    bash

    docker run -v "$(pwd)":/app:ro myapp

29. 29
    What happens to data written inside a container without a volume?
    It lives in the container’s writable layer and is lost when the container is removed
30. 30
    How do containers on the same user-defined network reach each other?
    By container (or Compose service) name, through Docker’s built-in DNS
31. 31
    Default network driver for standalone containers
    bridge
32. 32
    Compose v2 command to start services in the background
    bash

    docker compose up -d

    Compose v2 is a Docker CLI plugin: docker compose, not docker-compose.
33. 33
    Stop and remove Compose services (and their volumes)
    bash

    docker compose down
    docker compose down -v  # also removes named volumes

34. 34
    Start a service only after the database is healthy
    yaml

    services:
      api:
        depends_on:
          db:
            condition: service_healthy
      db:
        image: postgres:17
        healthcheck:
          test: ["CMD-SHELL", "pg_isready -U postgres"]
          interval: 5s

35. 35
    Does plain depends_on wait until a service is ready?
    No, only until it has started. Use condition: service_healthy with a health check
36. 36
    Compose profiles
    Services with profiles only start when that profile is enabled

    yaml

    services:
      adminer:
        image: adminer
        profiles: ["debug"]
    # docker compose --profile debug up

37. 37
    Rebuild images and start with Compose
    bash

    docker compose up -d --build

38. 38
    Run a one-off command in a Compose service
    bash

    docker compose run --rm api npm test

39. 39
    Where does Compose read variable substitutions like ${TAG} from?
    The shell environment and a .env file next to the compose file
40. 40
    Why use a -slim or alpine base image?
    Fewer packages mean smaller images, faster pulls and less attack surface

    Alpine uses musl libc, which some native modules don’t support.
41. 41
    Keep an image small when installing packages
    Combine install and cleanup in one RUN so deleted files never land in a layer

    dockerfile

    RUN apt-get update && apt-get install -y --no-install-recommends curl \
        && rm -rf /var/lib/apt/lists/*

42. 42
    Why shouldn’t secrets go in ENV or ARG?
    They end up in the image metadata or history where anyone with the image can read them

    Use build secrets (RUN --mount=type=secret) or runtime environment variables.
43. 43
    Why pin image tags instead of using latest?
    latest changes over time, so builds aren’t reproducible; pin a version or a digest
44. 44
    Show an image’s layers and the commands that made them
    bash

    docker history myapp:1.0

45. 45
    Inspect a container’s configuration as JSON
    bash

    docker inspect web

46. 46
    Copy a file out of a container
    bash

    docker cp web:/app/log.txt ./log.txt

47. 47
    Limit a container’s memory and CPU
    bash

    docker run --memory=512m --cpus=1.5 myapp

48. 48
    Restart policy that brings a container back after crashes and reboots
    bash

    docker run -d --restart unless-stopped myapp

49. 49
    Push an image to a registry
    bash

    docker tag myapp:1.0 ghcr.io/me/myapp:1.0
    docker push ghcr.io/me/myapp:1.0

50. 50
    Build for another CPU architecture
    bash

    docker buildx build --platform linux/arm64 -t myapp:arm64 .