images versus containers docker run container lifecycle foreground mode detached mode container logs docker exec docker inspect container naming automatic removal

FROM RUN COPY ADD WORKDIR ENV ARG CMD ENTRYPOINT EXPOSE

build context .dockerignore layer caching image tagging image history multi-stage builds minimal base images BuildKit secrets build cache mounts platform builds

named volumes bind mounts tmpfs mounts volume lifecycle volume inspect read-only mounts backup volume data restore volume data filesystem permissions storage drivers

bridge network host network none network custom network container DNS published ports port binding address network aliases network isolation network inspect

compose services compose build compose environment compose env_file compose depends_on compose healthcheck compose networks compose volumes compose profiles compose override files

rootless mode user directive Linux capabilities no-new-privileges read-only filesystem secrets CPU limits memory limits PID limits vulnerability scanning

registry login push and pull image digests private registry restart policies health checks docker stats logging drivers prune resources graceful stop