
What Is Docker? The Fundamentals
July 1, 2026 · 10 min read
Every developer has heard "works on my machine but not on the server." Docker was born to kill exactly that problem: it packages your app together with everything it needs to run (libraries, runtime, system tools) into one artifact that runs identically on your laptop, a server, or the cloud.
Image vs. container
Two core concepts. An image is a frozen template of your app — an immutable blueprint. A container is a live, running instance of that image. You can run as many containers as you want from one image — like creating many objects from one class.
Dockerfile: you describe the image
You describe how to build an image, step by step, in a text file called Dockerfile. For a sample Node.js app:
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]The commands you'll use most
- docker build -t myapp . → build an image from the Dockerfile
- docker run -p 3000:3000 myapp → start the container and publish the port
- docker ps → list running containers
- docker logs <id> → view a container's logs
- docker exec -it <id> sh → shell into a running container
Why it matters so much
Docker is the foundational building block of modern DevOps: Kubernetes orchestrates containers, CI/CD pipelines build images, cloud services run containers. Without understanding Docker you can't fully grasp Kubernetes or CI/CD.
Case: shrink a 900MB image to 90MB
The simple Dockerfile above works but is bloated: build tools, dev dependencies and source code all leak into the image. A prod image should be lean. Multi-stage builds solve exactly this.
$ docker build -t web:naive .$ docker images web:naiveREPOSITORY TAG SIZEweb naive 912MB # build tools + node_modules + source, all inside$ docker history web:naive | head -3 # where did the layers go?<missing> 380MB RUN npm install<missing> 280MB COPY . .
Multi-stage Dockerfile
# stage 1: build
FROM node:20 AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# stage 2: runtime only
FROM node:20-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
CMD ["node", "dist/server.js"]$ docker build -t web:slim .$ docker images web:slimREPOSITORY TAG SIZEweb slim 92MB # ✓ 912MB → 92MB (~90% smaller)
Warning
Common mistake: copying secrets (env, .aws, .git) into the image. 'COPY . .' grabs everything. Add a .dockerignore (node_modules, .git, .env) — it both shrinks the image and prevents secret leakage.
Mini task
Build a small Node/Go app first with a naive single-stage Dockerfile and measure the size. Then convert it to multi-stage and switch to an alpine base. Compare before/after with 'docker images'; target at least 70% reduction. Don't forget the .dockerignore.
Hands-on task — try it in your browser
The fastest way to learn is trying the commands in a terminal — which is exactly what Cloudpuz's interactive hands-on labs are built for.
Official sources
Last verified: 2026-07-17
Frequently Asked Questions
What is Docker?
Docker is a container technology that packages your app together with everything it needs to run (libraries, runtime, system tools) into one artifact. That artifact runs identically on your laptop, a server, or the cloud, eliminating the 'works on my machine but not on the server' problem.
What is the difference between a Docker image and a container?
An image is a frozen, immutable template of your app. A container is a live, running instance of that image. You can run as many containers as you want from one image, like creating many objects from one class.
What is a Dockerfile?
A Dockerfile is a text file where you describe how to build an image step by step. It defines the base image with FROM, plus commands like WORKDIR, COPY, and RUN for installing dependencies, and CMD for the command to run.
How do you shrink a Docker image size?
Using a multi-stage build reduces image size significantly: one stage compiles the app and a second stage takes only the runtime output. In the example, a naive 912MB image drops to 92MB (about 90% smaller) with multi-stage and an alpine base.
How do I prevent secrets from leaking into a Docker image?
'COPY . .' grabs everything into the image, so secret files like env, .aws, and .git can leak. Adding a .dockerignore file (node_modules, .git, .env) both shrinks the image and prevents secret leakage.
Reading isn't enough — do it.
Practice these topics in an interactive terminal in your browser.