Docker Training

Ondrej Sika (sika.io) | ondrej@sika.io | go to course -> | install docker -> | Skoleni Docker 🚀💻

Docker Training

About Course

Related Courses

Any Questions?

Write me mail to ondrej@sika.io

Course

About Me - Ondrej Sika

Freelance DevOps Engineer, Consultant & Lecturer

Complete DevOps Pipeline
Open Source / Linux Stack
Cloud & On-Premise
Technologies: Git, Gitlab, Gitlab CI, Docker, Kubernetes, Terraform, Prometheus, ELK / EFK, Rancher, Proxmox

Star, Create Issues, Fork, and Contribute

Feel free to star this repository or fork it.

If you found bug, create issue or pull request.

Also feel free to propose improvements by creating issues.

Chat

For sharing links & "secrets".

Slack - https://sikapublic.slack.com/
Microsoft Teams
https://sika.link/chat (tlk.io)

DevOps Kniha (Czech only)

https://kniha.sika.io

What is Docker?

Docker is a platform for containerization — packaging applications and their dependencies into isolated, portable units called containers.

It provides a consistent environment from a developer's laptop all the way to production, eliminating the classic "works on my machine" problem.

Containers vs. Virtualization

Virtualization

A virtual machine (VM) is an abstraction of physical hardware. Each VM emulates a full hardware stack — from BIOS to network adapters, storage, and CPU — which allows you to run any operating system on your host. This flexibility comes at a cost: VMs are resource-heavy and slow to start.

Containers

Containers are an abstraction at the Linux kernel level. Instead of emulating hardware, they isolate processes using kernel namespaces (PID, network, mount, IPC, etc.) and limit resource usage with cgroups (control groups).

Because containers share the host kernel, they start in milliseconds and consume far less memory than VMs. The trade-off is that you cannot run a different OS or kernel version inside a container — all containers on a host share the same kernel.

	Virtual Machines	Containers
Isolation	Full OS per VM	Kernel namespaces
Startup time	Minutes	Milliseconds
Size	GBs	MBs
Density	Tens per host	Hundreds per host

Images and Containers

Docker builds on two core concepts:

Image — a read-only, layered snapshot of a filesystem and its metadata. An image is built once and can be shared via a registry. It is immutable: running it never changes it.
Container — a running instance of an image. Multiple containers can run from the same image simultaneously, each isolated from the others with its own writable layer.

Think of an image as a class definition and a container as an object instantiated from it.

Usage of Docker

Docker is used throughout the entire software lifecycle:

Development — every developer runs the same environment regardless of their OS; onboarding is docker compose up instead of a 20-step setup guide.
Testing & CI — isolated containers make tests repeatable and parallel; each test run starts from a clean state.
Production — the exact same image tested in CI is deployed to production, removing environment drift.
Microservices — separate concerns into independently deployable services, each in its own container.

Docker Containers in a Cluster

A single Docker host is not enough for production workloads that need high availability and horizontal scaling. Container orchestrators manage fleets of containers across multiple hosts:

Kubernetes — the industry-standard orchestrator; handles scheduling, scaling, rolling updates, and self-healing.
~~Docker Swarm~~ — Docker's built-in orchestrator; largely superseded by Kubernetes.

12 Factor Apps

12factor.net

The 12-Factor methodology defines 12 rules for building modern, cloud-native applications. Containers and Docker naturally enforce many of these factors — for example, storing config in environment variables (factor III), treating logs as event streams (factor XI), and keeping the dev/prod environment identical (factor X).

Install Docker

Official installation - https://docs.docker.com/engine/installation/
My install instructions (in Czech) - https://ondrej-sika.cz/docker/instalace/
Bash Completion on Mac - https://blog.alexellis.io/docker-mac-bash-completion/

Test the installation

docker run hello-world

Remote Docker (over SSH)

You can use a remote Docker daemon over SSH. Export DOCKER_HOST pointing at the remote host and your local Docker client will transparently execute commands there.

export DOCKER_HOST=ssh://root@docker.sikademo.com
docker version
docker info

Docker plugin for VS Code

https://marketplace.visualstudio.com/items?itemName=ms-azuretools.vscode-docker Official Docker plugin for VS Code

https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers Official Dev Containers plugin for VS Code

Basic Usage

System Wide Info

docker version - print version
docker info - system wide information
docker system df - docker disk usage
docker system prune - cleanup unused data
docker volume prune --all - cleanup unused volumes (including named volumes)

Docker Images

docker pull <image> - download an image
docker image ls - list all images
docker image ls -q - quiet output, just IDs
docker image ls <image> - list image versions
docker image rm <image> - remove image
docker image inspect <image> - show image properties

Update all local images

docker image ls --format="{{.Repository}}:{{.Tag}}" | xargs -I {} docker pull {}

Docker Registry

Docker image name also contains location of it source. Those names can be used:

debian - Official images on Docker Hub
ondrejsika/debian - User (custom) images on Docker Hub
ghcr.io/ondrejsika/debian - Github Container Registry
ttl.sh/debian - Image in my own registry

Docker Hub

Official Images

Verified Publisher Images

https://hub.docker.com/search?badges=verified_publisher

Github Container Registry

ghcr.io

Docs: https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#about-the-container-registry

Own Docker Registry

Docker Registry is build in Gitlab and Github for no additional cost. You can find it in packages section.

Docker Registry in Self-Hosted Gitlab

You have to add registry_external_url to Your Gitlab config and reconfigure.

echo "registry_external_url 'registry.example.com'" >> /etc/gitlab/gitlab.rb
gitlab-ctl reconfigure

Harbor

Harbor is an open-source container image registry under CNCF.

ttl.sh - Anonymous & ephemeral Docker image registry

Crane

Install Crane

Mac

brew install crane

Linux (using slu)

slu install-bin crane

Copy Image

Copy image from one registry to another without pulling it to local machine.

crane copy <source> <destination>

example

crane copy ghcr.io/sikalabs/dev ttl.sh/dev

List Image Tags (versions)

crane ls ghcr.io/sikalabs/slu

Tag Image

Add a new tag to an existing image in a registry without pulling it locally.

crane tag <image> <new tag>

example

crane tag ttl.sh/dev:latest ttl.sh/dev:2026-01-01

Docker Run

docker run [ARGS] <image> [<command>]

Examples

Basic Docker Run

docker run hello-world

With custom command

docker run debian cat /etc/os-release

docker run ubuntu cat /etc/os-release

With TTY & Standart Input

docker run -ti debian

Containers

docker container ls - list containers
docker ps - list containers
docker start <container>
docker stop <container>
docker restart <container>
docker rm <container> - remove container

Common Docker Run Params

--name <name> - set container name (Wozniak easter egg)
-d - run in detached mode
-ti - map TTY a STDIN (for bash eg.)
-e <variable>=<value> - set ENV variable

Restart Policy

By default, if a container process stops or fails, the container is stopped.

You can choose another behavior using the --restart <policy> argument.

--restart no - never restart (default)
--restart on-failure - restart only when the container exits with a non-zero exit code
--restart always - always restart, even after a Docker daemon or host restart
--restart unless-stopped - like always, but a manually stopped container stays stopped across daemon restarts

To limit the number of retries for the on-failure policy, use: --restart on-failure:<count>

List Containers

docker container ls - list running containers
docker container ls -a - list all containers
docker container ls -a -q - list IDs of all containers

or

docker ps - list running containers
docker ps -a - list all containers
docker ps -a -q - list IDs of all containers

Example of -q

docker rm -f $(docker ps -a -q)

or my dra (docker remove all) alias

alias dra='docker ps -a -q | xargs -r docker rm -f'

dra

Or using slu:

slu s dra

Docker Exec

docker exec <container> <command>

Arguments

-d - run in detached mode
-e <variable>=<value> - set ENV variable
-ti - map TTY a STDIN (for bash eg.)
-u <user> - run command by specific user

Postgres 16 example

docker run --name pg16 -e POSTGRES_PASSWORD=pg -d postgres:16

docker exec -ti pg16 bash

docker exec -ti -u postgres pg16 psql

Postgres 17 example

docker run --name pg17 -e POSTGRES_PASSWORD=pg -d postgres:17

docker exec -ti pg17 bash

docker exec -ti -u postgres pg17 psql

Docker Logs

All containers have to log into STDOUT or STDERR.

Example of logging to STDOUT from legacy application - examples/log_to_file

Log Drivers

You can use native Docker logging or some log drivers.

For example, if you want to log into syslog, you can use --log-driver syslog.

See the logging docs: https://docs.docker.com/config/containers/logging/configure/

Json File (Default Log Driver)

Log Driver options:

max-size - Max size of log file (default -1 - unlimited), use for example 100k for kB, 10m for MB or 1g for GB.
max-file - Nuber of log rotated files (default 1)
compress - Compression for rotated logs (default disabled)

Examle:

docker run --name log-rotation -d --log-opt max-size=5m --log-opt max-file=2 ghcr.io/sikalabs/slu:v0.95.2 slu loggen -s 5

Global Log Configuration

You can set default log driver and options in /etc/docker/daemon.json

{
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  }
}

Log Collection Using Filebeat

See example: examples/filebeat

cd examples/filebeat
make

See logs in terminal, no elastic output is configured.

Log Collection Using Promtail

See example: examples/promtail

Run Loki and Grafana first

cd examples/grafana_with_loki
make

Then run Promtail

cd examples/promtail
make

Go to Grafana: http://lab0.sikademo.com:3000, configure Loki data source and explore logs.

Docker Inspect

Get lots of information about container in JSON.

docker inspect <container>

Inspect Format

Using Go Template Language.

Examples:

docker inspect loggen --format "{{.NetworkSettings.Networks.bridge.IPAddress}}"

docker inspect loggen --format "{{.LogPath}}"

Docker Volumes

Docs

Volumes are persistent data storage for containers.
Volumes can be shared between containers and data are written directly to host.

CLI

docker volume - all volume management commands
docker volume ls - list all volumes
docker volume rm <volume> - remove volume
docker volume prune - remove all not used (not bount to container) volumes

Examples

docker run -ti -v /data debian
docker run -ti -v my-volume:/data debian
docker run -ti -v $(pwd)/my-data:/data debian

Get Volume Paths from Image

docker image inspect redis --format "{{.Config.Volumes|json}}"

docker image inspect postgres:11 --format "{{.Config.Volumes|json}}"

Read only volumes

If you want to mount your volumes read only, you have to add :ro to volume argument.

Examples

docker run -ti -v my-volume:/data:ro debian
docker run -ti -v $(pwd)/my-data:/data:ro debian

First example does't make sense read only.

Show All Volumes & Mounts for All Containers

docker ps -a --format '{{ .ID }}' | xargs -I {} docker inspect -f '{{ .Name }} ({{ .ID }}){{ printf "\n" }}{{ range .Mounts }}{{ printf "\n\t" }}{{ .Type }} {{ if eq .Type "bind" }}{{ .Source }}{{ end }}{{ .Name }} => {{ .Destination }}{{ end }}{{ printf "\n" }}' {}

Find Containers Which Use Specific Volume

docker ps -a --filter volume=<volume>

Example

docker ps -a --filter volume=my-volume

Socket forwading

If you want to forward socket into container, you can also use volume. If you work with sockets, read only parameter doesn't work.

docker run -v /var/run/docker.sock:/var/run/docker.sock docker docker ps

or

docker run -v /var/run/docker.sock:/var/run/docker.sock -ti docker

!! Possible Security Risk !!

You can mount your's host rootfs to container with root privileges. Everybody ho has access to docker or docker socket has root privileges on your host.

userns-remap can fix that

docker run -v /:/rootfs -ti debian

userns-remap

Docker can remap root user from container to hight-number user on host.

More: https://docs.docker.com/engine/security/userns-remap/

Enabble userns-remap

dockerd argument

dockerd --userns-remap="default"

Config /etc/docker/daemon.json

{
  "userns-remap": "default"
}

Examples

docker run -v /:/rootfs -ti debian cat /rootfs/etc/shadow

docker run -v /:/rootfs -ti --userns=host debian cat /rootfs/etc/shadow

Docker In Docker

Run Docker in Docker

docker run --name docker -d --privileged docker:dind

Try run any Docker command in this container:

docker exec docker docker info
docker exec docker docker image ls
docker exec docker docker run hello-world
docker exec -ti docker sh

Port Forwarding

Docker can forward specific port from container to host

docker run -p <host port>:<cont. port> <image>

You can specify an address on the host as well

docker run -p <host address>:<host port>:<cont. port> <image>

Examples

docker run -ti -p 8080:80 nginx
docker run -ti -p 127.0.0.1:8080:80 nginx

The latter will make connection possible only from localhost.

See http://127.0.0.1:8080

Own Images

Dockerfile

Dockerfile is preferred way to create images.

Dockerfile defines each layer of image by some command.

To make image use command docker build

Dockerfile Commands

FROM <image> - define base image
RUN <command> - run command and save as layer
COPY <local path> <image path> - copy file or directory to image layer
ADD <source> <image path> - instead of copy, archives added by add are extracted
ENV <variable> <value> - set ENV variable
USER <user> - switch user
WORKDIR <path> - change working directory
VOLUME <path> - define volume
CMD <command> - command we want to run on container start up. Difference between CMD and ENTRYPOINT will be exaplain later
EXPOSE <port> - Define on which port the conteiner will be listening

.dockerignore

Ignore files for docker build process.
Similar to .gitignore

Example of .dockerignore for Next.js (Node) project

Dockerfile
out
node_modules
.DS_Store

Build Image from Dockerfile

docker build <path> -t <image> - build image
docker build <path> -f <dockerfile> -t <image>
docker tag <source image> <target image> - rename docker image

Cross Platform Build

Use --platform for cross platform builds

Build AMD64

docker build --platform linux/amd64 .

Build ARM64 (for Apple Silicon)

docker build --platform linux/arm64 .

Practice

Simple Image

See Simple Image example

Get Source

git clone https://github.com/ondrejsika/docker-training
cd docker-training/examples/simple-image
rm Dockerfile Dockerfile.debian

Image Size Differences

List images and see the difference in image sizes

docker image ls simple-image

Hadolint

Hadolint is Dockerfile linter.

Github: https://github.com/hadolint/hadolint

Install & Use Hadolint

Install on Mac

brew install hadolint

Install on Linux using slu

slu install-bin hadolint

Use hadolint

hadolint <dockerfile>

You can ignore checks & specify trusted registries

hadolint --ignore DL3003 --ignore DL3006 <dockerfile> # exclude specific rules
hadolint --trusted-registry registry.sikademo.com <dockerfile>

Use from Docker

You can also use Hadolint from Docker

docker run --rm -i hadolint/hadolint < Dockerfile
docker run --rm -i hadolint/hadolint hadolint --ignore DL3006 - < Dockerfile

or (for PowerShell)

cat Dockerfile | docker run --rm -i hadolint/hadolint
cat Dockerfile | docker run --rm -i hadolint/hadolint hadolint --ignore DL3006 -

Build Arguments

Example in Dockerfile

ARG FROM_IMAGE=debian:9
FROM $FROM_IMAGE

FROM debian
ARG PYTHON_VERSION=3.7
RUN apt-get update && \
    apt-get install python==$PYTHON_VERSION

Build using

docker build \
  --build-arg FROM_IMAGE=python .
docker build .

docker build \
  --build-arg PYTHON_VERSION=3.6 .

See Build Args example.

Multi Stage Builds

Dockerfile for multistage builds

FROM java-jdk AS build
RUN gradle assembly

FROM java-jre
COPY --from=build /build/demo.jar .

Build Multistage Images

# By default, last stage is used
docker build -t <image> <path>

# Select output stage
docker build -t <image> --target <stage> <path>

Examples

docker build -t app .
docker build -t build --target build .

Practice

Multistage Image

See Multistage Image example

Get Source

cd ../multistage-image
rm Dockerfile

Multistage image size differences

docker image ls multistage-image

ASP.NET Core Example

Source: https://github.com/dotnet/dotnet-docker/tree/master/samples/aspnetapp

git clone https://github.com/dotnet/dotnet-docker.git
cd samples/aspnetapp
docker build -t dotnet-example .
docker run -ti -p 8000:80 dotnet-example

See: http://127.0.0.1:8000

Entrypoint vs Command

Idea of entrtypoint is to run something before the main command.

It's done by "entrypoint" script which do some initialization and then run the main command.

The ENTRYPOINT and CMD instructions in a Dockerfile work together to define what command gets executed when running a container.

Dockerfile

ENTRYPOINT ["/entrypoint.sh"]
CMD ["myapp"]

entrypoint.sh

#!/bin/sh

echo "Running entrypoint script..."

exec "$@"

When Docker continer starts, it will execute /entrypoint.sh myapp. The script will run the inicialization and then use exec "$@" to replace itself with the myapp command.

Entrypoint Examples

Docker Networks

Docker support those network drivers:

bridge (default)
host
none
custom (bridge)

Bridge (default)

docker run debian:10 ip a

or using slu ipl

docker run ghcr.io/sikalabs/dev slu ipl

Host

docker run --net host debian:10 ip a

or using slu ipl

docker run --net host ghcr.io/sikalabs/dev slu ipl

None

docker run --net none debian:10 ip a

or using slu ipl

docker run --net none ghcr.io/sikalabs/dev slu ipl

Network Commands

docker network ls
docker network create <network>
docker network rm <network>

Create Network

Example:

docker network create -d bridge my_bridge

Run & Add Containers:

# Run on network
docker run -d --net=my_bridge --name nginx nginx
docker run -d --net=my_bridge --name apache httpd

# Connect to network
docker run -d --name nginx2 nginx
docker network connect my_bridge nginx2

Test the network

docker run -ti --net my_bridge ondrejsika/host nginx
docker run -ti --net my_bridge ondrejsika/host apache
docker run -ti --net my_bridge ondrejsika/curl nginx
docker run -ti --net my_bridge ondrejsika/curl apache

Macvlan Network

If you need assign IP addresses from your local network directly to containers, you have to use Macvlan.

https://docs.docker.com/network/macvlan/

docker network create -d macvlan \
  --subnet=192.168.101.0/24 \
  --ip-range=192.168.101.128/25 \
  --gateway=192.168.101.1\
  -o parent=eth0 macvlan

Macvlan Example on 192.168.54.0/24 network

Create the macvlan network

docker network create -d macvlan \
  --subnet=192.168.54.0/24 \
  --ip-range=192.168.54.128/25 \
  --gateway=192.168.54.1 \
  -o parent=eno1 \
  macvlan54

(optional) Fix host <-> container communication

ip link add macvlan-host link eno1 type macvlan mode bridge
ip addr add 192.168.54.129/32 dev macvlan-host
ip link set macvlan-host up
ip route add 192.168.54.128/25 dev macvlan-host

Run containers

docker run -d \
  --network macvlan54 \
  --ip 192.168.54.200 \
  --name my-200 \
  -e TEXT="192.168.54.200" \
  ghcr.io/sikalabs/hello-world-server

docker run -d \
  --network macvlan54 \
  --ip 192.168.54.201 \
  --name my-201 \
  -e TEXT="192.168.54.201" \
  ghcr.io/sikalabs/hello-world-server

Test

curl http://192.168.54.200:8000
curl http://192.168.54.201:8000

Note: The ip link / ip route commands (step 2) are lost on reboot. To make them persistent add them to /etc/network/interfaces or a systemd service.

ctop

ctop is a top-like interface for container metrics.

Install

Mac

brew install ctop

Using slu

slu install-bin ctop

Official installation instructions: https://github.com/bcicen/ctop#install

Run

ctop

or with Docker

docker run --rm -ti \
  --name=ctop \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  quay.io/vektorlab/ctop:latest

Portainer

Portainer is a web UI for Docker.

Homepage: portainer.io

Run Portainer

docker run -d --name portainer -p 8000:8000 -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer

See: http://127.0.0.1:9000

Run Portainer behind Traefik v1

docker run \
  -d \
  --name portainer \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  --label=traefik.enable=true \
  --label=traefik.frontend.rule=Host:portainer.lab0.sikademo.com \
  --label=traefik.port=9000 \
  --net traefik \
  portainer/portainer

See: https://portainer.lab0.sikademo.com

Run Portainer behind Traefik v2

https://github.com/ondrejsika/docker-compose-examples/tree/master/portainer

Nixery.dev

Nixery.dev provides ad-hoc container images that contain packages from the Nix package manager. Images with arbitrary packages can be requested via the image name.

More at https://nixery.dev/

Examples

docker run nixery.dev/hello hello

docker run -ti nixery.dev/htop htop

docker run -ti nixery.dev/shell/git/curl/mc bash

cAdvisor (Container Advisor)

google/cadvisor (homepage)

cAdvisor (Container Advisor) provides container users an understanding of the resource usage and performance characteristics of their running containers. It is a running daemon that collects, aggregates, processes, and exports information about running containers. Specifically, for each container it keeps resource isolation parameters, historical resource usage, histograms of complete historical resource usage and network statistics. This data is exported by container and machine-wide.

Install:

# use the latest release version from https://github.com/google/cadvisor/releases
VERSION=v0.49.2
docker run \
  --volume=/:/rootfs:ro \
  --volume=/var/run:/var/run:ro \
  --volume=/sys:/sys:ro \
  --volume=/var/lib/docker/:/var/lib/docker:ro \
  --volume=/dev/disk/:/dev/disk:ro \
  --publish=8080:8080 \
  --detach=true \
  --name=cadvisor \
  --privileged \
  --device=/dev/kmsg \
  gcr.io/cadvisor/cadvisor:$VERSION

Check out:

Web UI - http://127.0.0.1:8080/
/metrics (prometheus) - http://127.0.0.1:8080/metrics

Run behind Traefik v1

VERSION=v0.46.0
docker run \
  --volume=/:/rootfs:ro \
  --volume=/var/run:/var/run:ro \
  --volume=/sys:/sys:ro \
  --volume=/var/lib/docker/:/var/lib/docker:ro \
  --volume=/dev/disk/:/dev/disk:ro \
  --detach=true \
  --name=cadvisor \
  --privileged \
  --device=/dev/kmsg \
  --label=traefik.enable=true \
  --label=traefik.frontend.rule=Host:cadvisor.lab0.sikademo.com \
  --label=traefik.port=8080 \
  --net=traefik \
  gcr.io/cadvisor/cadvisor:$VERSION

See: https://cadvisor.lab0.sikademo.com

Run cAdvisor behind Traefik v2

https://github.com/ondrejsika/docker-compose-examples/tree/master/cadvisor

Distroless Images

Thank you! & Questions?

That's it. Do you have any questions? Let's go for a beer!

Docker Compose

What is Docker Compose?

Docker Compose is a tool for defining and running multi-container Docker applications.

With Docker Compose, you use a Compose file to configure your application's services.

`docker-compose` vs `docker compose`

docker-compose is the old command. docker compose is the new command. Both commands are the same.

`docker-compose.yml` vs `compose.yml`

docker-compose.yml is the old name. compose.yml is the new name. Both names are the same.

Validate you have `docker compose`

docker compose version

Example Compose File

services:
  app:
    build: .
    ports:
      - 8000:80
  redis:
    image: redis

Here is a compose file reference: https://docs.docker.com/reference/compose-file/

Here is a nice tutorial for YAML: https://learnxinyminutes.com/docs/yaml/

Service

Service is a container running and managed by Docker Compose.

Run Docker Compose

docker compose up [ARGS] [<service>, ...]

Example

docker compose up

Build Compose

Just build, don't run

docker compose build

Build without cache

docker compose build --no-cache

Build with args

docker compose build --build-arg BUILD_NO=53

Common Compose File Attributes

Image

Just pull & run image

services:
  app:
    image: redis

Build

Simple, just build path

services:
  app:
    build: .

Extended form with every build configuration

services:
  app:
    build:
      context: ./app
      dockerfile: ./app/docker/Dockerfile
      args:
        BUILD_NO: 1
    image: ttl.sh/app

Inline Dockerfile

services:
  example:
    build:
      dockerfile_inline: |
        FROM debian:12-slim
        CMD ["echo", "Hello from inline Dockerfile"]

Platoform specific build

services:
  example:
    build: .
    platform: linux/amd64

Port Forwarding

services:
  app:
    ports:
      - 8000:80
      - 127.0.0.1:80:80

Volume

Volumes are very similar but there is a little difference

services:
  app:
    volumes:
      - /data1
      - data:/data2
      - ./data:/data3

volumes:
  data:

Command

services:
  app:
    command: ["python", "app.py"]

Environment Variables

services:
  app:
    environment:
      RACK_ENV: development
      SHOW: "true"
      SESSION_SECRET:

ENV Files

services:
  app:
    env_file:
      - default.env
      - prod.env

Variable Substitution

Docker Compose uses standart bash variable substitution

Variable with Default Value

services:
  app:
    image: ${IMAGE:-ondrejsika/go-hello-world:3}

Mandatory Variable

services:
  app:
    image: ${IMAGE?Environment variable IMAGE is required}

YAML Anchors

x-base: &base
  image: debian
  command: ["env"]

services:
  en:
    <<: *base
    environment:
      HELLO: Hello
  cs:
    <<: *base
    environment:
      HELLO: Ahoj

Deploy

services:
  app:
    deploy:
      replicas: 4

Compose Project Name

name: "compose-name-example"

Create a Composite

See simple compose example

git clone https://github.com/ondrejsika/docker-training.git example--simple-compose
cd example--simple-compose/examples/simple-compose
rm Dockerfile docker-compose.yml

Try it wihout Docker Compose. Run the example:

docker build -t counter .
docker network create counter
docker run --name redis -d --net counter -v redis-data:/data redis
docker run --name counter -d --net counter -p 80:80 -e REDIS=redis counter

Stop & Remove

docker stop counter redis
docker rm counter redis
docker network rm counter

Now, we can create Docker compose and Compose File manually.

Create Dockerfile:

FROM python:3.7-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "app.py"]
EXPOSE 80

Try without Docker Compose

docker build -t counter .
docker network create counter
docker run --name redis -d --net counter redis
docker run --name counter -d --net counter -p 8000:80 counter
docker stop counter redis
docker rm counter redis
docker network rm counter

Create docker-compose.yml:

services:
    counter:
        build: .
        image: ttl.sh/examples/simple-compose/counter
        ports:
            - ${PORT:-80}:80
        depends_on:
            - redis
    redis:
        image: redis

Compose Commands

docker compose config - validate & see final docker compose yaml
docker compose ps - see all composite's containers
docker compose exec <service> <command> - run something in container
docker compose version - see version of docker-compose binary
docker compose logs [-f] [<service>] - see logs

Compose Up Arguments

-d - run in detached mode
--force-recreate - always create new cont.
--build - build on every run
--no-build - don't build, even images not exist
--remove-orphans

Manage Compose

docker compose start [<service>]
docker compose stop [<service>]
docker compose restart [<service>]
docker compose kill [<service>]

`docker compose up` vs `docker compose run`

docker compose up

run all services (or multiple selected services)
you can't specify command, volums, environment from cli arguments

docker compose run

run only one service
run dependencies on background
you can specify command, volums, environment from cli arguments

Stop and Remove Compose

docker compose down

Scaling Compose

docker compose up --scale <service>=<n>

Traefik

Traefik Architecture

Docker Compose Override

If you want override your compose.yaml (former docker-compose.yaml), you can use -f param for multiple compose files. You can also create compose.override.yaml (former docker-compose.override.yaml) which will be used automatically.

See compose_override example.

Podman

Install Podman

apt-get install podman

Create User for Podman

useradd -m -s /bin/bash podman

Try Podman

su - podman

podman run hello-world

podman run -p 8000:8000 ghcr.io/sikalabs/hello-world-server

Podman shortnames.conf

Shortnames project is collecting registry alias names for shortnames to fully specified container image names.

https://github.com/containers/shortnames/blob/main/shortnames.conf

See your shortnames

cat /etc/containers/registries.conf.d/shortnames.conf

Thank you! & Questions?

That's it. Do you have any questions? Let's go for a beer!

Ondrej Sika

email: ondrej@sika.io
web: https://sika.io
twitter: @ondrejsika
linkedin: /in/ondrejsika/
Newsletter, Slack, Facebook & Linkedin Groups: https://join.sika.io

Do you like the course? Write me recommendation on Twitter (with handle @ondrejsika) and LinkedIn (add me /in/ondrejsika and I'll send you request for recommendation). Thanks.

Wanna to go for a beer or do some work together? Just book me :)

Training Sessions

2025-12-01

https://github.com/sika-training-examples/2025-12-02_counter_project_docker_example - Docker Compose project with Gitlab CI
https://github.com/sika-training-examples/2025-12-02_docker_caddy_cloudflare_example - Caddy with Cloudflare DNS challenge example (for infra behind VPN)

2025-10-20

2025-09-23

https://github.com/sika-training-examples/2025-09-23-docker-compose-example

2022-09-22 TTC

https://github.com/sika-training-examples/2022-09-22--ttc--docker-compose

Docker FAQ

DNS Troubles in Docker Build

If you see something like that, it may be caused by DNS server trouble.

You can check see your DNS server using:

docker run debian cat /etc/resolv.conf

Or check if it works:

docker run ondrejsika/host google.com

You can fix it by setting Google or Cloudflare DNS to /etc/docker/daemon.json:

{ "dns": ["1.1.1.", "8.8.8.8"] }

Name		Name	Last commit message	Last commit date
Latest commit History 629 Commits
.git-hooks		.git-hooks
.github		.github
_images		_images
examples		examples
.editorconfig		.editorconfig
.gitignore		.gitignore
CLAUDE.md		CLAUDE.md
Makefile		Makefile
README.md		README.md
package.json		package.json
yarn.lock		yarn.lock

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

Docker Training

About Course

Related Courses

Any Questions?

Course

About Me - Ondrej Sika

Star, Create Issues, Fork, and Contribute

Chat

DevOps Kniha (Czech only)

What is Docker?

Containers vs. Virtualization

Virtualization

Containers

Images and Containers

Usage of Docker

Docker Containers in a Cluster

12 Factor Apps

Install Docker

Test the installation

Remote Docker (over SSH)

Docker plugin for VS Code

Basic Usage

System Wide Info

Docker Images

Docker Registry

Docker Hub

Github Container Registry

Own Docker Registry

Docker Registry in Self-Hosted Gitlab

Harbor

ttl.sh - Anonymous & ephemeral Docker image registry

Crane

Install Crane

Copy Image

List Image Tags (versions)

Tag Image

Docker Run

Examples

Containers

Common Docker Run Params

Restart Policy

List Containers

Docker Exec

Docker Logs

Log Drivers

Json File (Default Log Driver)

Global Log Configuration

Log Collection Using Filebeat

Log Collection Using Promtail

Docker Inspect

Inspect Format

Docker Volumes

Get Volume Paths from Image

Read only volumes

Show All Volumes & Mounts for All Containers

Find Containers Which Use Specific Volume

Socket forwading

!! Possible Security Risk !!

userns-remap

Enabble userns-remap

Examples

Docker In Docker

Port Forwarding

Own Images

Dockerfile

Dockerfile Commands

.dockerignore

Build Image from Dockerfile

Cross Platform Build

Practice

Simple Image

Get Source

Image Size Differences

Hadolint

Install & Use Hadolint

`docker-compose` vs `docker compose`

`docker-compose.yml` vs `compose.yml`

Validate you have `docker compose`

`docker compose up` vs `docker compose run`