Glossary

146 terms from Docker Basics, in plain words, each with the chapter that teaches it.

Search the glossary

#

--name: A `docker run` option that gives a container a name of your choice instead of a random two-word one. Names must be unique, and on a user-defined network they double as hostnames.
--rm: A `docker run` option that deletes the container automatically when it stops. It keeps short jobs from leaving stopped containers behind.
-d (detached): A `docker run` option that starts the container in the background and prints its ID, so your terminal stays free. Kettle & Crane's `web` server runs this way.
-e / --env-file: Options that set environment variables for one container: `-e` sets a single value, `--env-file` loads many from a file. They override `ENV` defaults from the image.
-it: Options that connect your terminal to a container so you can type into it: `-i` keeps input open and `-t` gives it a terminal. Used to get a Python or bash session inside a container.
-p (publish): A `docker run` option that connects a port on your computer to a port in the container, written `YOURPORT:CONTAINERPORT`. Without it, a container's server can't be reached from your browser.
-v (mount): A `docker run` option that mounts storage into a container: a volume name gives a named volume, a folder path gives a bind mount. It is how a database's data outlives its container.
.dockerignore: A file in the build context listing what to leave out of the build, using the same patterns as `.gitignore`. It keeps secrets like `.env` and junk out of the image.
.gitignore: A file listing what Git must never commit. Sam lists `.env` in it so passwords don't end up in the repository.
2>&1: Shell syntax that redirects a program's error output (stderr) into its normal output (stdout) so both can be piped together to tools such as `grep` or `tail`. It is useful with `docker logs`, because programs like Gunicorn and Postgres write their log messages to the error stream.

A

Alpine Linux: A tiny Linux distribution used for very small image variants. It uses different system libraries, so some Python packages must be compiled during the build and may fail.
amd64 / arm64: The two main processor families: amd64 (Intel and AMD, most servers and PCs) and arm64 (Apple silicon Macs, some servers). An image built for one fails on the other with `exec format error`.
Anonymous volume: A volume with a long random name that Docker creates when you don't name one, such as when you forget `-v` with Postgres. It is easy to lose track of, so always name your volumes.

B

Base image: The image a Dockerfile starts from with `FROM`, such as `python:3.15-slim` for the price list.
bash: A common Linux command-line shell. `docker run -it --rm python:3.15-slim bash` gives you a bash prompt inside a container.
Bind mount: A folder on your own computer made visible inside a container, so edits you make show up immediately. Its source must be an absolute path (`"$PWD"` holds the current folder's path), and the `:ro` suffix makes it read-only inside the container.
Build cache: Stored layers from earlier builds that Docker reuses when a step and everything it depends on are unchanged. Once one step reruns, all later steps rerun too.
Build context: The folder whose files a build may use, usually the `.` you give to `docker build`. All of it is sent to the engine, so `.dockerignore` keeps junk and secrets out.
Build stage: One `FROM` section of a multi-stage Dockerfile. Later stages can copy files from earlier ones, and only the last stage becomes the final image.

C

CMD: The Dockerfile instruction that sets the default command a container runs. The bracket list form (exec form) runs the program directly without a shell, and a command given after the image name replaces it.
CMD-SHELL: A health check test form that runs the command through a shell (`sh -c`), whereas `CMD` runs a program directly. Used for `pg_isready -U postgres`.
Commit: Saving a database change for good. In psycopg, a `with` block that ends without an error commits the insert.
compose.yaml: The file that describes a multi-container app (services, volumes, ports) for Docker Compose. Compose reads it from the project folder.
Container: A running (or stopped) copy of an image, kept separate from everything else on the computer. You can start many containers from one image.
Containerize: To package an app as an image so it can run in containers.
COPY: The Dockerfile instruction that copies files from the build context into the image, such as `index.html` into nginx's web folder.
COPY --from: A `COPY` form that takes files from an earlier build stage instead of the build context. It is how a multi-stage build moves results into the final image.
curl: A command-line tool that sends a request to a URL and prints the response, commonly used to test web servers. Useful options include `-s` to hide the progress meter, `-L` to follow redirects and `-d` to send form data as a POST.
CVE: The ID given to a published security vulnerability. Docker Scout reports the CVEs found in an image's packages.

D

Daemon: A program that runs in the background waiting for requests. The Docker Engine is the daemon that does the work when you type `docker` commands.
Dangling image: An old build left with no tag after you rebuilt under the same name. `docker image prune` removes them.
DATABASE_URL: The environment variable the app reads to find its database, in the form `postgresql://USER:PASSWORD@HOST:PORT/DATABASE`. The host is the database container's name, such as `db`.
Debian: A popular version of Linux. The official Python image contains Debian with Python installed.
Decorator: A line starting with `@` that adds behavior to the Python function below it. In Flask, `@app.route("/")` says which page runs `price_list`.
Default bridge network: The network a container joins if you don't choose one, called `bridge`. Containers on it can't look each other up by name.
depends_on: A Compose setting that controls start-up order. By default it waits only for a container to start; with `condition: service_healthy` it waits for the health check to pass.
Digest: An image's unique fingerprint, written `sha256:...`. Pinning a digest in `FROM` fixes the exact image you get.
DNS: The service that turns names into network addresses. A user-defined Docker network has a built-in DNS server, so `web` can reach the database at the name `db`.
docker build: Builds an image by following a Dockerfile. `-t` names the image, `-f` picks a different Dockerfile, the final `.` is the build context, `--no-cache` ignores the build cache and `--pull` checks for a newer base image.
docker builder prune: Deletes the build cache to free disk space; later builds will be slower.
docker buildx build: A build command that can produce images for several platforms at once and push them under one tag, so Intel and Arm computers each pull the right one.
Docker client: The `docker` command itself, which only sends requests to the Docker Engine.
Docker Compose: The tool that runs multi-container apps from one `compose.yaml` file with a single command. It replaces long `docker run` commands.
docker compose config: Prints a Compose project's final configuration with every `${...}` filled in, which helps catch mistakes. It shows your secrets, so don't share the output.
docker compose down: Stops and removes a project's containers and network but keeps its volumes. `down -v` also deletes the volumes and their data.
docker compose ps / logs / exec: Compose versions of `ps`, `logs` and `exec` that work on a whole project: list its containers, show service logs and run a command in a service's container.
docker compose up: Builds what needs building, creates the network and volumes and starts all services; `-d` runs them in the background and `--build` rebuilds images first. With `--no-build` (after `docker compose pull`) it never builds, which suits a server that has no Dockerfile.
docker container prune: The `prune` commands delete unused items: stopped containers, dangling images, unused volumes, or several kinds at once. `-f` skips the confirmation; `-a` removes more, and with volumes deletes named ones.
docker cp: Copies files between your computer and a container, using `name:path` for the container side.
Docker Desktop: An app for macOS, Windows and Linux that installs Docker, Compose and a window for viewing images and containers. It's free for small businesses like Kettle & Crane.
Docker Engine: The background service (daemon) that downloads and builds images and starts and stops containers. On a Linux server you often install it on its own.
docker exec: Runs a command inside a running container, for example `docker exec -it web bash` for a shell. It fails if the container is stopped.
docker history: Lists an image's layers, newest first, with the instruction and size of each. It also reveals any `ENV` lines.
Docker Hub: Docker's public registry, where official images like Python, nginx and PostgreSQL are published and where you can share your own.
Docker ID: Your Docker Hub user name, which must start your image names when you push, as in `samkc/pricelist`.
docker image ls: Lists the images on your computer; `docker image rm name:tag` removes a tag, and the image itself when its last tag goes.
docker inspect: Shows every detail of a container or image as JSON; `--format` picks out single fields like the command, user or health status.
docker login: Signs in to a registry such as Docker Hub or GHCR so you can push or pull private images. `docker logout` removes the saved sign-in, and `--password-stdin` reads the password from a pipe.
docker logs: Shows what a container's program has printed. `--tail N` shows the last lines and `-f` follows new output until Ctrl+C.
docker network: Commands that create and list Docker networks, such as `docker network create kc-net`.
docker ps: Lists running containers; `-a` includes stopped ones. `--format` chooses the columns shown.
docker pull / docker push: `docker pull` downloads an image from a registry and `docker push` uploads one. `docker run` also pulls automatically if the image is missing.
docker run: Creates a container from an image and starts it, following the pattern `docker run IMAGE COMMAND`. It pulls the image first if it isn't on your computer.
Docker Scout: A Docker tool that checks an image's packages against databases of known CVEs and lists the fixes. `quickview` summarizes and `cves` lists each issue.
docker start / stop / restart / rm: Commands that control containers: `stop` asks the program to shut down cleanly, `start` runs it again with its files as they were, `restart` does both and `rm -f` stops and removes in one go.
docker system df: Shows how much disk space images, containers, volumes and the build cache use, and how much is reclaimable.
docker tag: Gives an existing image an additional name, such as a version number or a registry-ready name like `samkc/pricelist:2.1.0`. The new name points to the same image ID.
docker version: Shows the versions of both the Docker client and the engine, which also checks that the engine is running.
docker volume: Commands that create, list, inspect and delete volumes. `docker volume rm` deletes a volume and its data for good, and refuses while a container uses it.
docker-entrypoint-initdb.d: A folder in the Postgres image: when it creates a new database it runs any `.sql` files found there. Compose bind-mounts `init.sql` into it to create tables on first start.
Dockerfile: A plain text file named `Dockerfile` that lists the steps for building an image, one instruction per line.

E

ENTRYPOINT: A program that always runs first in a container and receives your command as its arguments. `--entrypoint` replaces it, for example to get a plain shell in the Postgres image.
ENV: The Dockerfile instruction that sets a default environment variable in the image, such as `ENV PORT=8000`.
Environment variable: A named setting that every program can read. Containerized apps like the price list read their configuration, such as the shop name or database password, from them.
Exit code: The number a program ends with; 0 means success and anything else means failure. `Exited (0)` in `docker ps -a` shows it.
EXPOSE: A Dockerfile instruction that records which port the app listens on. It is documentation only; you still need `-p` to publish the port.

F

Flask: A popular Python package for building web apps, used for the price list and the orders app.
FROM: The Dockerfile instruction that names the base image to start from. Every Dockerfile begins with one, and a multi-stage build has several.

G

GET, POST: The two web request types the orders app uses: GET fetches a page (viewing the order list) and POST sends data such as a submitted form (placing an order).
GHCR: GitHub Container Registry, at ghcr.io, a registry for images that is handy when your code is already on GitHub. Image names look like `ghcr.io/OWNER/IMAGE:TAG`.
grep: A command that prints only the lines of its input that contain a given piece of text. It is often used at the end of a pipe to pick out one line from longer output, as in `grep h1`.
Gunicorn: A web server for Python web apps, used instead of Flask's built-in server, which isn't meant for production. It starts workers, each a copy of the app that handles requests.

H

Header: Extra information sent with a web reply. `Content-Type: text/plain` tells the browser to show the reply as plain text, not a web page.
Health check: A command Docker runs inside a container every few seconds; exit code 0 means healthy and repeated failures mean unhealthy. Compose can wait for a service to be healthy before starting others.
Host addresses (127.0.0.1, 0.0.0.0): `127.0.0.1` is the numeric address of localhost: a server listening only on it accepts connections just from its own computer (inside a container, just from that container). `0.0.0.0` means 'all network addresses', which a containerized server must use to accept traffic arriving through a published port; `[::]` is the same idea in IPv6, the newer, longer style of address.
HTML: The language of web pages, used for Sam's wholesale price page and the order form.
HTTP status codes: Numbers a web server returns with its reply: 200 OK, 303 See Other (a redirect telling the browser to load another address, used after a POST), 404 not found and 500 server error.

I

Image: A read-only package holding an app and everything it needs, like a frozen, ready-to-run copy of a small computer's disk. Containers are started from images.
Instruction: A capitalized keyword at the start of a Dockerfile line, such as `FROM`, `COPY` or `RUN`, that tells Docker one build step. Each instruction that changes files makes a layer.

J

Join (SQL): A SQL operation that pairs rows from two tables, as the orders report pairs each order with the product whose code it holds.
JSON: A text format for structured data. `docker image inspect` prints an image's details as JSON.

K

Kernel: The core of an operating system that manages memory, files and hardware. All containers on a computer share its kernel, while each virtual machine has its own.
Kubernetes: A system that runs containers across many servers, suggested for when one server isn't enough.

L

LABEL: A Dockerfile instruction that stores extra information, as key-value metadata, in an image. For example, the `org.opencontainers.image.source` label links an image on GitHub Container Registry to its GitHub repository.
Layer: The changes made by one Dockerfile instruction; an image is a stack of layers. Layers are shared between images and cached between builds.
Linux: The operating system family whose kernel containers use. On Mac and Windows, Docker runs a small Linux VM to host your containers.
localhost: A computer's name for itself. Inside a container, localhost means the container itself, not your computer or other containers.
Logs: Whatever a container's program prints, which Docker keeps so you can read it with `docker logs`. They are the first place to look when something goes wrong.

M

Mount: Making storage from outside a container appear at a path inside it, so what's written there outlives the container. Volumes and bind mounts are the two main kinds.
Mountpoint: The place where a volume's files really live, inside Docker's Linux system (inside the VM on Docker Desktop).
Multi-stage build: A Dockerfile with several `FROM` stages where only the last becomes the image. It leaves build tools like Python behind, as in the `kc-prices` image.

N

Network: A private virtual network inside Docker that containers join; `--network` puts a container on one. On a user-defined network containers can reach each other by name; on the default `bridge` network they can't.
nginx: A widely used web server and reverse proxy, pronounced 'engine-x'. It serves static pages such as Kettle & Crane's wholesale page and can sit in front of an app such as a Flask app to pass requests along to it.

O

Official image: An image that a project such as Python, nginx or PostgreSQL publishes and maintains on Docker Hub, shown with `library/` in its full name (for example `library/python`). Official images are a trusted starting point for running software or building your own images.
OOMKilled: Shown when a container was killed for using too much memory; it typically exits with code 137.

P

Personal access token: A long password for one purpose, used to sign in to Docker Hub from scripts or to GHCR. GHCR needs a classic token with the `write:packages` scope.
pg_dump: A Postgres tool that prints the SQL needed to rebuild a database, used for backups.
pg_isready: A small tool in the Postgres image that checks whether the database is answering. It's used for network tests and for the database health check.
Pinning: Fixing an exact version so builds don't change unexpectedly: exact versions in `requirements.txt`, a full tag such as `python:3.15.1-slim`, or an image digest in `FROM`.
pip: Python's package installer. The Dockerfile uses `pip install -r requirements.txt` to install Flask and Gunicorn; `--no-cache-dir` keeps its download cache out of the image.
Platform: The processor and operating system an image is built for, such as `linux/arm64`. An image built for one platform won't run on another.
Port: A numbered door that a network program listens behind; web servers use port 80, Postgres 5432. Only one program can use each port on your computer.
PostgreSQL: A popular free database server. Its official image needs `POSTGRES_PASSWORD` and keeps data in `/var/lib/postgresql/data`.
Primary key: A column whose values must be unique for each row, such as a product's `code`, so no two products can share it.
Production: Running an app for real users rather than for testing. Flask's built-in server shouldn't be used in production.
proxy_pass: An nginx setting that forwards matching requests to another server, such as the `web` service on port 8000. A trailing `/` changes whether the matched path is kept.
psql: Postgres's command-line client, included in the Postgres image. `-U` picks the user and `-c` runs one SQL command.
psycopg: The Python package the apps use to talk to Postgres (version 3, successor to psycopg2). `psycopg[binary]` installs a ready-built version.
Publish (a port): Connecting a port on your computer to a port in a container with `-p`, so programs outside Docker can reach the container.

R

References (foreign key): A SQL rule that a column's values must match a column in another table. `orders.product` references `products.code`, so orders for unknown products are refused.
Registry: A website that stores and shares images, such as Docker Hub or GHCR.
Repository (image): All versions of one image under one name, such as `library/python`. An image's full name is registry, repository and tag.
requirements.txt: A file listing the Python packages an app needs, with exact versions so every build gets the same ones.
Restart policy: A setting (`restart:` in Compose, `--restart` in `docker run`) for when Docker restarts a container whose main process stops, for example after a TERM signal such as `kill 1`. `unless-stopped` restarts after crashes or reboots but respects a manual stop; Docker doesn't restart merely unhealthy containers.
Reverse proxy: A server that receives every request and forwards some to other servers. In the Compose setup, nginx forwards `/prices/` to the Flask app.
root: The Linux administrator user. Containers run as root unless the image says otherwise, which is riskier if an attacker breaks into the app.
RUN: A Dockerfile instruction that runs a command while building and saves the result in the image, such as `pip install`.

S

Secret: A setting that must stay private, such as a database password, API key or token. Keep secrets out of Dockerfiles and images and pass them at run time from a file listed in `.gitignore` and `.dockerignore`.
Semantic versioning: A version scheme `MAJOR.MINOR.PATCH`: raise PATCH for fixes, MINOR for new features and MAJOR for changes that may break things.
Service: One container definition in a Compose file, such as `web`, `db` or `proxy`. A service's name is also its name on the network.
Shell: A program where you type commands, such as bash or `sh`. You can open one inside a container to look around.
Slim: An image variant, such as `python:3.15-slim`, that contains a minimal Debian and Python and is much smaller than the full image. It is a good default base for Python apps.
SQL: The language for querying and changing databases, used for the products and orders tables.
SQL injection: An attack where user input pasted into SQL runs its own commands. The orders app uses `%s` placeholders so psycopg inserts values safely.
systemctl: A Linux command that starts and stops services; `sudo systemctl start docker` starts the Docker engine.

T

Tag: A label for one version of an image, after the colon, such as `3.15-slim`. With no tag Docker assumes `latest`, which is only a default name and doesn't mean newest.

U

USER: The Dockerfile instruction that makes later instructions and the running container use a normal user instead of root; `useradd` creates that user. The app can then use but not change installed packages.
User-defined network: A network you create yourself, such as `kc-net`, which includes DNS so containers can find each other by name. The default `bridge` network has no name lookup.

V

Virtual machine: Software that imitates a whole computer with a complete operating system and its own kernel. VMs are heavy and slow to start compared with containers.
Volume: Docker-managed storage identified by a name that outlives containers. It keeps data like the `kc-data` database safe when containers are replaced.
Vulnerability: A known flaw that an attacker could use. Smaller images contain fewer programs and so fewer possible flaws.

W

Web server: A program that runs until stopped, answering requests from browsers by sending back pages. nginx is one.
WORKDIR: The Dockerfile instruction that creates a folder and makes it the working directory for later instructions and the running container, like `mkdir -p` and `cd` together.
Worker: A copy of the app that Gunicorn starts to handle requests. More workers can handle more requests at once.
WSL 2: Windows Subsystem for Linux, which Docker Desktop on Windows uses to run Linux containers.

Y

YAML: The indented text format of `compose.yaml`, with `key: value` pairs nested by two-space indentation (never tabs) and list items starting with `- `.