Frequently Asked Questions About KodeKloud Docker Containerisation Blueprint
23 answers covering everything from basics to advanced usage.
// Basics
What is the 'Matrix from Hell' in Docker?
The Matrix from Hell is the compatibility tangle between services, library versions, OS versions, and environments that makes building, shipping, and running multi-component applications unreliable. For example, your frontend server needs library version A while your cache needs version B — they conflict on bare metal. Docker solves this by packaging each component into its own container with its own isolated dependencies.
What is Docker Engine versus Docker Desktop?
Docker Engine is the free, open-source core — the docker CLI and the dockerd daemon that runs on a Linux server. Docker Desktop is a native Mac/Windows application that wraps Docker Engine with a GUI and extra tooling, requiring a paid subscription for commercial use in larger companies. For learning and Linux servers, Docker Engine is the recommended foundation.
What does the -d flag do in docker run?
The -d flag runs a container in detached mode — in the background — so the terminal is immediately returned to you and the container continues running independently. Use it for any long-running background service like a database or cache. Without -d, the terminal is consumed by the container's stdout and pressing Ctrl+C kills the service.
What are containerd and runC?
They are the container runtime components Docker uses under the hood, replacing LXC since version 0.9.0. runC is the OCI-compliant reference implementation that actually creates and runs containers, while containerd manages the full container lifecycle. Together they enable containers to share the host OS kernel while staying isolated.
// How To
How do I install Docker Engine on Ubuntu?
Add Docker's apt repository, then run apt install to install docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin, and docker-compose-plugin. Confirm the daemon is running with systemctl status docker, then validate the full stack by running docker run hello-world. If hello-world prints its success message, your installation is working end to end.
How do I import a large SQL file into a containerised database?
Use docker run -i (not -it) to pipe the SQL file into the container's stdin. The -i flag connects standard input without requiring a terminal, so the import streams directly into the containerised database. Adding -t would cause Docker to refuse the pipe because pipes are not terminals. This needs no exposed host ports or persistent shell session.
How do I run two database versions side by side?
Pull both tagged images (e.g. current stable and target upgrade), then run each with docker run -d mapping them to different host ports like 3306 and 3307. Each container has its own isolated file system and volume mapping, so there are no conflicts. Use docker inspect to confirm each container's network settings and mount points before migrating data.
How do I clean up unused Docker containers and images?
Stop containers with docker stop <name|id>, remove them with docker rm (multiple IDs allowed), and delete images with docker rmi <image>:<tag> — but only after removing all containers referencing that image. For a full sweep, docker system prune removes all stopped containers, unused networks, dangling images, and build cache. It's safe in dev but use caution on shared hosts.
How do I onboard a new developer with Docker?
Encode all environment complexity into a Dockerfile and Docker Compose file so onboarding becomes a single command. The developer verifies Docker Engine is installed, then runs docker compose up (or docker pull plus docker run with the right -p and -v flags per service). They never touch the host package manager, so the Matrix from Hell is bypassed regardless of their OS.
// Troubleshooting
Why does docker rmi fail to delete my image?
docker rmi fails if any container — including stopped or exited ones — still references the image. Run docker ps -a to find hidden dependents, remove them with docker rm, then retry docker rmi. Stopped containers are often invisible with plain docker ps, which only shows running containers, so the -a flag is essential for spotting the blockers.
Why does Docker refuse my piped input with -it?
Because a pipe is not a terminal, and -it requests a pseudo-terminal. When you pipe data into a container you must use -i alone, which connects standard input without demanding a TTY. Reserve -it for interactive shell sessions where you type commands. Confusing the two is a common cause of failed streaming imports and scripted data loads.
Why am I getting 'too many requests' errors when pulling images?
You're hitting Docker Hub rate limits: 100 unauthenticated pulls per 6 hours per IP, 200 per 6 hours on the free Personal tier after docker login, and unlimited on paid plans. This bites CI pipelines hardest because many builds share one IP. Always run docker login (or use a paid plan) in CI to authenticate before pulling images.
Why can't external users reach my containerised app?
A container's internal IP is only reachable from within the Docker host. To expose it externally you must publish a port with -p <host_port>:<container_port>. Without port mapping, the app runs fine inside the container but is invisible to outside users. Also confirm no two containers are mapped to the same host port, since each host port binds to only one container.
Why did my data disappear after removing a container?
Any data written inside a container without a volume mapping is destroyed when the container is removed. Stateful services must persist data using -v <host_dir>:<container_dir> or --mount so the external volume survives deletion. If you forgot the volume flag, the data is unrecoverable — always plan persistence before running databases or upload services in containers.
// Comparisons
How does Docker compare to a generic 'install everything on the host' approach?
Installing services natively on the host recreates the Matrix from Hell — conflicting library versions, OS-specific quirks, and 'works on my machine' failures. Docker isolates each service with its own pinned dependencies so the same configuration runs identically everywhere. Onboarding drops from pages of setup docs to a single command, and operations deploy the exact image a developer verified.
How does Docker Compose compare to running individual docker run commands?
docker run commands are fine for one or two containers, but they scatter configuration across shell history and tribal knowledge. Docker Compose defines all services, port mappings, volumes, and inter-service dependencies in one version-controlled file. For multi-service stacks it makes the whole environment reproducible and startable with docker compose up, removing manual per-container flag juggling.
Are containers a replacement for virtual machines?
No — they are complementary. Containers share the host kernel and are lightweight, while VMs run full guest operating systems and provide stronger isolation. In large environments you use virtualisation to provision and decommission Docker hosts elastically, then use Docker to provision and scale applications rapidly on those hosts. It's containers and VMs, not containers or VMs.
Do Linux containers run natively on Windows?
No. When Docker Desktop runs a Linux container on Windows, it actually runs inside a Linux VM under the host. The kernel-sharing constraint still applies — the container shares the Linux VM's kernel, not the Windows kernel. Assuming native Windows execution leads to confusion about performance and networking behaviour on Windows hosts.
// Advanced
What is a Dockerfile and why does it matter for DevOps?
A Dockerfile is a version-controlled file that encodes all build instructions for an image. It transforms the ops runbook into a reproducible artefact jointly owned by developers and operations. Once a developer builds and verifies the image, operations deploy that same image unchanged — guaranteeing identical behaviour in production. This shared artefact is the foundation of DevOps culture.
How should I choose which alternative registry to use?
Beyond Docker Hub, pick a registry aligned with your platform: GitHub Container Registry for GitHub-hosted projects, AWS ECR for AWS workloads, Google Artifact Registry for GCP, and Azure Container Registry for Azure. Private registries avoid Docker Hub rate limits and keep proprietary images internal. In CI, authenticate to your chosen registry before pulling to prevent throttling.
What is OCI and why does interoperability matter?
The Open Container Initiative (OCI) is the open standard defining how container runtimes and image formats should work, ensuring interoperability across the ecosystem. Because Docker's runC is the OCI reference implementation, images and runtimes built to the standard work across compliant tools. This prevents lock-in and lets you move images between registries and runtimes reliably.
When should I use --mount instead of -v?
Use --mount when you want explicit, unambiguous configuration — it spells out the mount type (bind, volume, or tmpfs), source, and target. The -v shorthand is quicker but less clear, especially in scripts and Compose files reviewed by teams. For production and shared artefacts, the explicit --mount form reduces mistakes about what kind of mount you're creating.
Should I pull images before running them?
Pulling explicitly with docker pull <image>:<tag> before docker run is optional but recommended so runs don't block on download time. It also surfaces rate-limit and authentication issues early rather than mid-deploy. In CI pipelines, always docker login first, then pull, to avoid the 'too many requests' cap on unauthenticated Docker Hub pulls.