Painless Docker

Name: Painless Docker
Author: Aymen El Amri

Unlock the Power of Docker and its Ecosystem

Available as: Kindle, Paperback, Online course

Get it on Amazon

Read on FAUN.sensei()

What You'll Learn

Build and optimize container images that stay small and reproducible
Wire up Docker networking, volumes and Compose for real applications
Harden containers for production, from least privilege to image scanning

About This Book

A step-by-step guide to mastering Docker and its ecosystem. Learn containerization from the ground up — from images and volumes to networking, orchestration, and production-ready security. Ideal for developers transitioning to modern DevOps and microservice-based workflows.

Preface
- Who This Guide is For
- What You Will Learn
- About the Author
- Join the Community
- Your Feedback Matters
How to Use This Guide
- The Companion Kit
- Heredoc
- Long Commands
The Missing Introduction to Containerization
- We Are Made by History
- History Is Layered, Not Isolated
- OS Containers vs. App Containers
- Docker's Place in Container History
- Does CRI Mean the Death of Docker?
- The Open Container Initiative: What is a Standard Container?
- The Birth of the Moby Project: When Docker Outgrew Itself
Hack the Container: Understanding Docker's Inner Workings
- Prerequisites
- Peekaboo Kernel: Understanding Namespaces and Cgroups
- A Deep Dive into Container Prototyping with runC
- containerd, shim and runC: How Everything Works Together
- Docker Runtimes: An Overview
- Adding a New Runtime to Docker
- Where Docker and containerd Store Data on the Host
Introduction to Docker CLI
- Docker CLI
- General Information About Your Docker Installation
- Docker Help
- The 4 Resources of Docker
Docker Containers
- Creating Containers
- Running Containers
- TTY, Interactive and Detached Modes
- Restarting Containers
- Stopping Containers
- Pausing and Unpausing Containers
- Sending Signals to Containers
- Removing and Pruning Containers
- Container Lifecycle
- Starting Containers Automatically
- Accessing Container Ports
- Running Commands in Containers
- Running Docker in Docker
Managing Container Resources
- Memory Usage Reservations and Limits
- CPU Usage Reservations and Limits
Docker Images
- What is an Image?
- Images are Layers
- Managing & Inspecting Images
- Tags and Digests
- Intermediate Images & Dangling Images
Dockerfile: Instructions, Best Practices, and Gotchas
- The Dockerfile
- Dockerfile Instructions
- Key Takeaways
Optimizing Docker Builds: Everything You Need to Know
- The Base Image
- Extending the Base Image
- Optimizing Docker Builds: The Multi-Stage Build
- Optimizing Docker Builds: Caching Strategies & Best Practices
- Optimizing Docker Builds: Leveraging BuildKit Caching & Advanced Techniques
- Optimizing Docker Builds: Reducing the Context Size
- Optimizing Docker Builds: The Base Image
Docker Volumes & Data Management
- Why and When to Use Volumes?
- What is a Docker Volume?
- Creating and Using Docker Volumes
- Listing and Inspecting Docker Volumes
- Named Volumes vs Anonymous Volumes
- Bind Mounts
- Volume Initialization Behavior
- Data Propagation & Updates
- Dangling Volumes
- TMPFS Mounts
Docker Networks
- Docker Networking Model
- Understanding the Bridge Network
- User-Defined Bridge Networks
- The Host Network
- The None Network
- The Macvlan Network
Cleaning Docker
- Delete Volumes
- Delete Networks
- Delete Images
- Remove Docker Containers
- Cleaning Up Everything
Modern Docker OCI Registries
- Why Use a Registry?
- Types of Registries
- Deployment of an OCI Registry
- Harbor Security Scan & SBOM
- Replication of Images
Docker Compose: A Mini Orchestration Tool for Local Development
- What Is Docker Compose & Why Should I Care?
- Understanding Docker Compose and How it Works
- Understanding Docker Compose Syntax
- Managing Service Dependencies
- Healthchecks and Wait-for-it Scripts
- Using Dockerfile with Docker Compose
- Docker Compose with Bind Mounts
- Creating Custom Networks
- Docker Compose Secrets
- Scaling Docker Compose Services
Logs: Container/Daemon Logging, Logging Drivers & Best Practices
- Understanding Docker Logs Internals
- Logging Best Practices and Recommendations
- Logging Drivers
- Docker Daemon Logging
Common Security Threats
- Docker vs. VMs: Which is more secure?
- Kernel Panic and Container Exploits
- Container Breakouts and Privilege Escalation
- Poisoned Images
- Denial-of-Service (DoS) Attacks
- Compromising Secrets
- Application-Level Threats
- Host System-Level Threats
- setuid/setgid Binaries
Docker Security Best Practices
- Secure by Design and DevSecOps
- setuid/setgid Binaries
- Control Resources
- Sign Your Images for Integrity and Authenticity
- Scan your Images for Vulnerabilities and Misconfigurations
- Set Container Filesystem to Read-Only
- Set Volumes to Read-Only
- Do Not Use the Root User
- Avoid Environment Variables for Sensitive Data & Use a Secret Manager
- Disable Inter-Container Communication (ICC)
- Know Your Software Bill of Materials (SBOM)
- Privileged Mode & Capabilities
- Use Seccomp
- Use AppArmor to Restrict Container Actions
- Use SELinux
- Use Docker Hardened Images
Docker API
- Docker SDKs
- Docker API: Hello World
- Prototyping a Log Collector Service
Debugging and Troubleshooting
- Docker daemon logs
- Activating Debug Mode
- Debugging Docker Objects
- Troubleshooting Docker Using Sysdig
Docker Events
- Using Docker Events for Troubleshooting
- Prototyping a Docker Events Listener
Understanding How Docker Swarm Works
- What is Docker Swarm?
- Creating a Swarm Cluster
- Swarm Services and Tasks
- Networking in Docker Swarm
- Performing Operations on Nodes
- Multi-manager Docker Swarm
- Docker Swarm Environment Variables and Secrets
- Docker Swarm Volumes
- Docker Swarm Limitations, Challenges & Use Cases
Deploying Applications on Docker Swarm: A Practical Guide
- Deploying a WordPress Application on Docker Swarm
- Docker Swarm Global Services
- Docker Swarm Resource Management
Deploying and Managing Services at Scale with Docker Swarm
- Docker Swarm Stacks
- Docker Swarm Rolling Updates
- Healthchecks and Restart Policies
- Dependencies Between Services in Docker Swarm
- Using an External Load Balancer with Docker Swarm
- Using Traefik as a Front-End Load Balancer with Docker Swarm
- Integrating Traefik with the WordPress Stack
- Docker Swarm Logging
Docker Model Runner: Running Machine Learning Models with Docker
- Docker Model Runner Overview
- Pulling and Running Models
- LLM Models: Back to the Basics
- Understanding How to Choose Model Variants
- Docker Model Runner APIs
- A Better User Experience with OpenWebUI
Afterword
- Let's Stay Connected
- Your Feedback Matters

Who This Is For

Developers and operators moving from virtual machines to containers, who want the mental model as well as the commands.

About the Author

Aymen El Amri is a software engineer, author and founder. He runs eralabs, built FAUN.dev, and writes about cloud native systems, AI engineering and developer tooling. More about Aymen.