3.6.2. Container Operations, Volumes, and Networking

💡 First Principle: Container storage is ephemeral by default — anything written inside the container's writable layer is lost when the container is removed. Volumes are the mechanism for persistent data: they exist outside the container lifecycle, are managed by the container runtime, and can be mounted into multiple containers.

Container Lifecycle Operations:

# Run containers
docker run nginx                              # Run in foreground
docker run -d nginx                           # Detached (background)
docker run -d -p 8080:80 nginx                # Map host port 8080 to container port 80
docker run -d --name webserver nginx          # Assign a name
docker run -it ubuntu:22.04 /bin/bash         # Interactive terminal
docker run --rm ubuntu:22.04 ls /             # Auto-remove when finished

# Manage running containers
docker ps                                     # Running containers
docker ps -a                                  # All containers (including stopped)
docker stop webserver                         # Graceful stop (SIGTERM)
docker kill webserver                         # Force stop (SIGKILL)
docker start webserver                        # Start stopped container
docker restart webserver                      # Stop then start
docker rm webserver                           # Remove stopped container
docker rm -f webserver                        # Force remove running container
docker container prune                        # Remove all stopped containers

# Inspect and troubleshoot
docker logs webserver                         # Stdout/stderr from container
docker logs -f webserver                      # Follow logs (like tail -f)
docker inspect webserver                      # Full JSON metadata
docker exec -it webserver /bin/bash           # Open shell in running container
docker exec webserver ls /etc/nginx           # Run single command
docker top webserver                          # Processes inside container
docker stats                                  # Live CPU/memory/network stats
docker stats --no-stream                      # One-shot stats snapshot

Volume Operations:

# Named volumes (managed by Docker — data persists independently)
docker volume create mydata
docker volume ls
docker volume inspect mydata
docker volume rm mydata
docker volume prune                            # Remove unused volumes

# Run with named volume
docker run -d -v mydata:/var/lib/mysql mysql   # Mount mydata to /var/lib/mysql

# Bind mounts (host path mapped into container)
docker run -d -v /host/data:/container/data:ro nginx   # Read-only bind mount
docker run -d -v $(pwd)/config:/etc/nginx/conf.d nginx  # Relative path expanded

# SELinux volume labels (important for RHEL/Podman)
docker run -d -v /host/data:/data:Z nginx      # :Z relabels for container use
docker run -d -v /host/data:/data:z nginx      # :z allows shared access by multiple containers

Container Networking:

# Network management
docker network ls                             # List networks
docker network create mynet                   # Create bridge network
docker network create --driver overlay mynet  # Overlay (for Swarm)
docker network inspect mynet                  # Network details
docker network rm mynet
docker network prune                          # Remove unused networks

# Run with specific network
docker run -d --network mynet nginx
docker run -d --network host nginx            # Use host networking (no isolation)
docker run -d --network none nginx            # No network access

Container Network Types:

Privileged vs. Unprivileged Containers:

docker run --privileged myimage     # Full host capabilities (dangerous)
docker run --cap-add SYS_ADMIN      # Add specific capability
docker run --cap-drop ALL --cap-add NET_BIND_SERVICE  # Minimal capabilities

Privileged containers can access all host devices and bypass security policies — essentially root on the host. Avoid in production; use --cap-add to grant only the specific capability needed.

⚠️ Exam Trap: Port mapping syntax is host_port:container_port. So -p 8080:80 maps requests to the host's port 8080 to port 80 inside the container. Reversing this (-p 80:8080) would expose port 80 on the host but the nginx inside (listening on 80) would never receive them. The exam tests whether you can read port mappings correctly.

Reflection Question: You need to run a MySQL container with data that persists across container restarts and removal. The container must be accessible from the host on port 3307 (not the default 3306). Write the docker run command.