Docker 核心概念: Container 不是魔法 是Linux Process + Isolation

1
2

Image     = Class definition
Container = instance created by new

1
2
3
4
5
6

FROM golang:1.25-alpine    ← Layer 1: base OS + Go toolchain
WORKDIR /app               ← Layer 2: create working directory
COPY go.mod go.sum ./      ← Layer 3: copy dependency definitions
RUN go mod download        ← Layer 4: download packages
COPY . .                   ← Layer 5: copy source code
RUN go build -o server ... ← Layer 6: compile

1
2
3
4
5
6
7

First build:
  FROM alpine  → Layer A (hash: abc123) ← created
  RUN go build → Layer B (hash: def456) ← created

Code changed, second build:
  FROM alpine  → Layer A (hash: abc123) ← cache hit, reused
  RUN go build → Layer C (hash: ghi789) ← new layer, Layer B still exists but unused

1
2
3
4

COPY go.mod go.sum ./   ← copy only these two files first
RUN go mod download     ← download packages (this layer gets cached)
COPY . .                ← then copy source code
RUN go build ...

1
2

COPY . .                ← any code change invalidates this layer
RUN go mod download     ← re-downloads packages every time

1
2
3
4
5

Image (all read-only layers)
     +
thin writable layer (belongs to this container only)
     =
Container

1
2

golang:alpine  → has compiler, compiles .go into binary (builder stage)
scratch        → empty, only holds the compiled binary (final stage)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

FROM golang:1.25-alpine AS builder

WORKDIR /app

COPY go.mod go.sum ./
RUN go mod download

COPY . .

RUN CGO_ENABLED=0 GOOS=linux go build -o server ./cmd/server/

FROM scratch

COPY --from=builder /app/server /server

EXPOSE 8080

ENTRYPOINT ["/server"]

1
2
3

.git
*.md
server

1
2

Full OS (ubuntu)  →  distroless  →  scratch (empty)
     risky            middle          smallest

1
2
3
4

pull latest (= 11.0) → docker run → container A frozen at 11.0

pull latest (= 12.0) → new image arrives
                       container A still runs 11.0, completely unaffected

1
2
3

REPOSITORY    TAG       IMAGE ID
mssql         latest    abc123     ← new 12.0
<none>        <none>    def456     ← old 11.0, still used by a container

1
2
3
4
5

# correct update flow after code changes
docker build -t go-api .
docker stop old-container
docker rm old-container
docker run -p 8080:8080 go-api

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# create container with volume mounted
docker run --name sql-old \
  -v sql-data:/var/opt/mssql \
  mssql/server:2019

# upgrade version, keep data
docker stop sql-old
docker rm sql-old
docker run --name sql-new \
  -v sql-data:/var/opt/mssql \
  mssql/server:2022

1
2

docker volume ls
docker volume rm sql-data

1
2
3
4
5

# not recommended
docker pull mssql/server:latest

# recommended
docker pull mssql/server:2022-CU14-ubuntu-22.04

1
2
3
4
5

# export as file
docker save go-api | gzip > go-api.tar.gz

# import on another machine
docker load < go-api.tar.gz

1
2
3
4

docker run -d --name my-api go-api

# visible directly on host
ps aux | grep server

1
2
3

Isolation
├── cannot see outside    → Namespace
└── cannot use too much   → cgroup

1
2
3
4

entire building          = your Linux host (shared kernel)
each separate room       = each container
walls and door locks     = Namespace (cannot see neighbors)
electricity quota/room   = cgroup (limited resources per container)

1
2
3
4

Host sees:                         Container sees:
PID 1  → systemd                   PID 1  → server (your Go app)
PID 891 → server (Go app)          (cannot see any host processes)
PID 892 → nginx

1
2
3

Host:          eth0 (192.168.1.100)
Container A:   eth0 (172.17.0.2)  ← isolated virtual network interface
Container B:   eth0 (172.17.0.3)

1

docker run --cpus="0.5" --memory="512m" go-api

1
2

VM:        Hardware → Hypervisor → Guest OS (full Kernel) → Process
Container: Hardware → Host Linux Kernel → Container Runtime → Process (Namespace + cgroup)

1
2
3
4
5
6
7
8

ubuntu image compromised:
  has bash → run arbitrary commands
  has curl → download malicious tools
  has apt  → install anything

scratch compromised:
  no shell → cannot run interactive commands
  no tools → almost nothing can be done

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Each Dockerfile instruction
  └── produces a Layer (read-only, hashed, immutable)
      └── multiple Layers stacked = Image (read-only template)
          └── docker run = Image + writable layer = Container (running process)
              ├── Namespace → cannot see outside (PID / Network / Mount)
              └── cgroup   → cannot use too much (CPU / Memory)

Container operations:
  docker stop / start  → restart, binary unchanged, code changes have no effect
  docker build         → rebuild, new image, code changes take effect
  Volume               → persistent data, independent of container lifecycle