What is Docker, and why do developers use it?

The core ideas

• Image: a read-only package containing your app and everything it needs, built from a Dockerfile.
• Container: a running instance of an image, isolated from other processes.
• Dockerfile: the recipe for building an image.
• Registry: a place to store and share images, such as Docker Hub or GitHub Container Registry.
• Compose: a file describing several containers that work together.

A minimal example

FROM node:22-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]

Build it with docker build -t my-app . and run it with docker run -p 3000:3000 my-app.

Why developers use it

• The same environment everywhere ends it works on my machine.
• New team members start the whole stack with one command.
• App platforms such as Railway, Render and Fly.io can deploy a Dockerfile directly.
• Dependencies, such as a specific database version, run without installing them on your machine.

Container or virtual machine?

A virtual machine includes a full operating system and is isolated by a hypervisor. A container shares the host's kernel and isolates only the process, so it is lighter and starts in seconds, with weaker isolation. Many production systems run containers inside virtual machines to get both.

Security basics

• Do not bake secrets into images. Anyone with the image can read them. Pass them as environment variables at runtime.
• Run as a non-root user, as the USER line above does.
• Use small, official base images and rebuild regularly to pick up security updates.
• Publish only the ports you need, and bind development databases to localhost.
• Add a .dockerignore so .env files, .git and local data never enter the image.

A database container started with its port published to all interfaces on a cloud server is reachable from the internet. Check what you expose.

Common problems

• Connection refused from the host: the app listens on 127.0.0.1 inside the container. Bind to 0.0.0.0.
• Huge images: no .dockerignore, or build tools left in the final image. Use multi-stage builds.
• Data lost on restart: databases need a volume.

What a scan can and cannot tell you

WebAuditOS sees containerized sites from outside like any other: headers that disclose server and framework versions, error pages that leak stack traces, and everything else a visitor meets.

It cannot inspect your images, Dockerfiles, exposed internal ports or base image vulnerabilities. Image scanners such as Docker Scout or Trivy cover that.

Version headers often reveal the exact runtime inside your container. Removing them costs nothing.

Short answers

Is Docker free? Docker Engine is open source. Docker Desktop is free for personal and small business use, with paid plans for larger companies.

Do I need Docker for a simple website? No. Static hosts and app platforms run most sites without it.

What is the difference between an image and a container? An image is the package. A container is the package running.

Is Docker the same as Kubernetes? No. Kubernetes orchestrates many containers across many machines.