Lab: your first Docker container and image

Aim and what you need

The aim is to understand the basic Docker loop: pull or build an image, run a container, look inside it, then remove it. Everything runs on your own computer, so there is no cloud cost.

• A computer with 8 GB RAM or more. On Windows or macOS install Docker Desktop (Windows uses WSL 2, the Windows Subsystem for Linux). On Linux install Docker Engine from your distribution or Docker's own repository.
• A terminal and a text editor.
• About 1 GB of free disk space.

Note: Docker Desktop is free for personal use, education and small businesses, but larger companies need a paid subscription. Check before using it at work.

Steps

1. Check the install and run the test image.
2. Run nginx in the background, mapping port 8080 on your computer to port 80 in the container, then browse to http://localhost:8080.
3. List, inspect and open a shell in the container.
4. Create a folder mysite containing an index.html and the Dockerfile below.
5. Build the image with a tag, run it on port 8081 and browse to it.

docker version
docker run --rm hello-world

docker run -d --name web -p 8080:80 nginx:alpine
docker ps
docker logs web
docker exec -it web sh
exit

# mysite/Dockerfile
FROM nginx:alpine
COPY index.html /usr/share/nginx/html/index.html
EXPOSE 80

cd mysite
docker build -t mysite:1.0 .
docker image ls
docker run -d --name mysite -p 8081:80 mysite:1.0
docker history mysite:1.0

How to verify and troubleshoot

Your browser should show the nginx welcome page on port 8080 and your own page on 8081. docker ps should list both containers with status Up. Each page view appears in docker logs. Change index.html, rebuild as mysite:1.1 and notice that the original container still shows the old page: containers do not change when you rebuild an image.

• Port is already allocated: another program uses that port; pick a different host port such as 8082.
• Permission denied on the Docker socket (Linux): use sudo or add your user to the docker group, then log out and in. Membership of that group is effectively root access, so only do it on your own machine.
• Cannot connect to the Docker daemon: start Docker Desktop or the docker service.
• Old page after rebuild: stop and remove the old container and run a new one from the new tag.

Clean-up and next steps

docker stop web mysite
docker rm web mysite
docker image rm mysite:1.0 nginx:alpine
docker system df
docker system prune

Prune removes stopped containers, unused networks and dangling images, so read its prompt before agreeing. Good next steps are using small, trusted base images, running as a non-root user and scanning images, covered in Docker hardening, then moving on to the minikube lab.