Docker

Docker uses a client-server architecture. There is no requirement that the daemon and client be run on the same machine.

Docker containers are not full VMs but instead special processes running in the host (on Linux). Containers have their own filesystems, process trees, and networking hardware, all completely separate from the host's. This isolation makes them immensely useful for running multiple applications with conflicting dependencies or for trying out new software.

Note that there need not be a one-to-one correspondence between containers and images. A container is a single instance of an image with its own unique resources. Once created, a container can be stopped, started, renamed, destroyed, and so on.

Images contain the app binaries and dependencies, along with instructions on how to build a container. They are in many ways analogous to git repositories (e.g., push/pull commands, tags).

Docker allows data persistence through one of two means: volumes and bind mounts. Bind mounts are exactly what they sound like — directories on the host that shared directly with the container. Volumes, on the other hand, are completely managed by Docker and have extra functionality.

Much of Docker's flexibility follows from Dockerfile inheritance. Every Dockerfile begins with a FROM directive indicating a base image.

A full Dockerfile reference is available here.

Docker Compose eases the instantiation of multi-container applications.