Docker is a platform for packaging software into containers: standardised units that contain an application together with everything it needs to run, such as libraries, runtime and configuration. A container runs the same way on a developer's laptop, a test server and in production, which ends the classic "it works on my machine" problem. Docker was released in 2013 and made containers mainstream; its image format is now an open standard (OCI) that other tools such as Podman and Kubernetes also use.
How does Docker work?
- Dockerfile: a text file with instructions to build an image, such as the base image, files to copy, dependencies to install and the command to start.
- Image: the built, read-only package of the application. Images are made of layers, so unchanged parts are cached and reused.
- Container: a running instance of an image, isolated from other containers, with its own file system, network and processes.
- Registry: a place to store and share images, such as Docker Hub, GitHub Container Registry or a private registry.
- Docker Compose: a file that describes several containers that belong together, such as an app, a database and a cache, and starts them with one command.
Containers vs. virtual machines
A virtual machine emulates a complete computer, including its own operating system. Containers share the kernel of the host operating system and only isolate the application. That makes containers much lighter: they start in seconds instead of minutes, use less memory, and many more of them fit on one server. Virtual machines provide stronger isolation, which is why containers in the cloud usually run on top of virtual machines.
Why use Docker?
- Consistent environments: development, testing and production run the same image.
- Fast onboarding: a new developer starts the whole stack with one command.
- Reliable deployments: the image that passed the tests is exactly what goes to production, and rolling back means starting the previous image.
- Portability: containers run on any server or cloud that supports containers, which limits lock-in.
- Foundation for scaling: containers are the building block for Kubernetes, microservices and automated CI/CD pipelines.
Points of attention
Keep images small and up to date: a minimal base image and multi-stage builds reduce both size and attack surface, and images should be rebuilt regularly for security updates. Don't put secrets in images; pass them in at runtime. Data that must survive a restart belongs in volumes or a managed database, not in the container. See our Docker services and what is DevOps.
Frequently Asked Questions about Docker
Is Docker free?
Docker Engine and the command-line tools are open source and free. Docker Desktop, the application for Windows and Mac, is free for individuals, education and small businesses, but requires a paid subscription for larger companies.
What is the difference between Docker and Kubernetes?
Docker builds and runs containers. Kubernetes orchestrates many containers across a cluster of servers: it decides where they run, restarts them when they fail and scales them with demand. They are complementary.
Does Docker work on Windows?
Yes. Docker Desktop runs Linux containers on Windows via WSL 2, and Windows Server can also run native Windows containers.
Is a container secure?
Containers are isolated, but less strictly than virtual machines. Run containers without root privileges, use trusted and updated base images, scan images for vulnerabilities and give each container only the access it needs.