Docker packages an application and everything it needs into a container, so it runs the same way on your laptop, a teammate’s machine, and a server. Docker’s documentation defines a container as “an isolated process with all of the files it needs to run.” This guide explains what that means, how to write a first Dockerfile, how to run several services with Docker Compose, how to keep data with volumes, and what has changed in Docker’s own tutorials in the last year, including free hardened base images and updated licensing for Docker Desktop.
Containers vs Virtual Machines
Docker’s “What is a container?” page contrasts containers with virtual machines. A virtual machine is “an entire operating system with its own kernel, hardware drivers, programs, and applications.” Containers on one host share a single kernel, and each one is an isolated process. That is why containers start faster and use less memory than full virtual machines, though the documentation page does not give numbers for either. The practical meaning for a beginner: a container carries your app and its libraries, not a whole operating system.
What You Need to Install
Docker Desktop
Docker Desktop is the easiest way to get started on Windows and Mac. As of October 17, 2026, the latest release is Docker Desktop 4.95.0, released October 12, 2026, with Compose 5.6.0 listed in its release notes. The latest Docker Engine is 29.9.1, released October 14, 2026. Many tutorials still show Engine versions from 24 to 27, so do not worry if your numbers are higher.
Is It Free?
Docker’s pricing FAQ says Docker Desktop is free for small businesses, meaning fewer than 250 employees and less than US$10,000,000 in annual revenue (both conditions), as well as for personal use and non-commercial open source. Government entities must buy a subscription. Docker Engine, the open-source software, is available to everyone. Paid plans are priced per user per month: Pro at $11 monthly or $9 annually, Team at $16 or $15, and Business at $24.
Alternatives
Podman is an Apache 2.0 project, with a current stable release of 6.1.4 and Podman Desktop 1.30.5, per its website. OrbStack is free for personal, non-commercial use and charges $8 per user per month for Pro, according to its pricing page. The pages reviewed do not describe how each compares on features, so this article does not rank them.
Your First Dockerfile
A Dockerfile is a text file of instructions for building an image. The following example comes from Docker’s “Writing a Dockerfile” page:
FROM python:3.13
WORKDIR /usr/local/app
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
COPY src ./src
EXPOSE 8080
RUN useradd app
USER app
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]Read it from top to bottom. FROM chooses the base image. WORKDIR sets the folder inside the container. COPY brings in your files, copying the requirements file first so Docker can cache the installed packages. RUN executes a command during the build. EXPOSE documents the port. RUN useradd and USER app make the process run as a non-root user, which is safer. CMD sets the command that starts when the container runs.
A Big Change: Docker Hardened Images
Docker’s current official guides no longer use plain public images in every example. The Python guide has you run docker login dhi.io and use images such as dhi.io/python:3.12-dev. These are Docker Hardened Images (DHI). Docker’s December 17, 2025 press release says more than 1,000 of them, built on Debian and Alpine, became “free and fully open source under the Apache 2.0 license,” available at dhi.io and through Docker Hub, with “No subscription required, no usage restrictions.” Docker’s pricing page lists the community version as free, while a paid DHI Select tier starts at $5,000 per repository and adds FIPS and STIG compliance with SLA-backed patching.
Multi-Stage Builds
Docker’s multi-stage documentation explains that you use multiple FROM statements in one Dockerfile, so build tools stay out of the final image. Here is the Python example from Docker’s own guide:
# syntax=docker/dockerfile:1
FROM dhi.io/python:3.12-dev AS builder
WORKDIR /app
RUN python3 -m venv /venv
ENV PATH="/venv/bin:$PATH"
RUN --mount=type=cache,target=/root/.cache/pip \
--mount=type=bind,source=requirements.txt,target=requirements.txt \
pip install -r requirements.txt
COPY . .
EXPOSE 8000
CMD ["/venv/bin/python3", "-m", "uvicorn", "app:app", "--host=0.0.0.0", "--port=8000"]
# Use the minimal runtime image for production. It runs as nonroot by default.
FROM dhi.io/python:3.12
WORKDIR /app
COPY --from=builder /venv /venv
ENV PATH="/venv/bin:$PATH"
COPY --from=builder /app .
EXPOSE 8000
CMD ["/venv/bin/python3", "-m", "uvicorn", "app:app", "--host=0.0.0.0", "--port=8000"]The first stage installs packages into a virtual environment. The second stage starts from the minimal runtime image and copies only the finished environment and code. The comment in the file notes that the runtime image runs as a non-root user by default.
Keep Junk Out With .dockerignore
Docker’s guide includes a .dockerignore file so that files such as .git, .venv, .env, node_modules, pycache, README.md, and Dockerfile copies are not sent to the build. Excluding .env matters because it often holds secrets.
Running Containers and Keeping Data
Volumes
Docker’s documentation says “Volumes are a storage mechanism that provide the ability to persist data beyond the lifecycle of an individual container.” Without a volume, data written inside a container disappears when the container is removed. The guide’s example commands are docker volume create log-data and docker run -d -p 80:80 -v log-data:/logs docker/welcome-to-docker.
Everyday Commands
The official guides use docker compose up –build to build and start, the -d flag to run in the background, docker compose ps to list services, docker compose logs followed by the service name to read output, docker compose watch for live updates during development, and docker compose down to stop and remove everything.
Docker Compose for Multiple Services
Compose lets you describe an app and its dependencies, such as a web server and a database, in one file. The official guides use a file named compose.yaml. Docker’s reference says the top-level version property is only informative and you will “receive a warning message that it is obsolete if used,” because Compose always uses the most recent schema. If you copy older examples, delete the version line. The Node guide builds a multi-stage setup and uses a compose file to add Postgres, but this research could not copy that file verbatim, so follow the live guide.
Docker Hub Limits
Docker Hub limits how many images you can pull. The pull-limits documentation, updated September 3, 2026, says unauthenticated users get 100 pulls per six hours per IPv4 address or IPv6 /64 subnet, free personal accounts get 200 per six hours, and Pro, Team, and Business accounts have unlimited pulls subject to fair use. Docker’s pricing page footnote describes personal accounts differently, as 100 pulls per hour with reasonable use. Because the two pages disagree, treat the documentation figure as authoritative and check both before you plan around the limit. Logging in helps in either case.
Common Beginner Mistakes
Do not put secrets in a Dockerfile or image. Do not run as root when you can avoid it. Do not skip the .dockerignore file. Do not rely on container storage for data you need to keep. Do not use a floating tag like latest in production, since it can change under you; pin a version. Rebuild images regularly to pick up security patches.
A Learning Path
- Install Docker Desktop and run the welcome container.
- Write a Dockerfile for a small app.
- Add a .dockerignore file.
- Use a volume for any data you need to keep.
- Move to Compose when you add a database.
- Learn multi-stage builds to shrink images.
- Try Docker Hardened Images for production.
A Worked Example: From Code to Running Container
Here is the whole flow in plain steps, using the commands from Docker’s guides. Write the Dockerfile and a .dockerignore file in your project folder. Build and run with docker compose up –build, which builds the image and starts the container together. Add -d to run in the background, then use docker compose ps to see what is running and docker compose logs followed by the service name to read output. When you change code, docker compose watch can sync files during development. When you finish, docker compose down stops and removes the containers. This loop is the daily rhythm of working with Docker, and most problems show up in the logs.
Reading the Layers
Docker builds images in layers, one per instruction. That is why the example Dockerfile copies the requirements file and installs packages before copying the source code: if only your code changes, the package layer is reused. The cache mount in the multi-stage example serves a similar purpose for pip downloads. This is a general feature of Docker builds, not something the pages reviewed quantify, so measure the speedup on your own project.
Security Habits Worth Building Early
Run your app as a non-root user, as both example Dockerfiles do. Keep .env files out of the image with .dockerignore. Prefer minimal runtime images, which is the point of the second stage in the multi-stage example and of Docker Hardened Images. Rebuild regularly. And remember that Docker Desktop’s license terms depend on your company’s size and revenue, so a team that outgrows the free thresholds should check the pricing FAQ before assuming nothing changes.
Docker Terms in Plain Language
An image is a read-only template built from a Dockerfile. A container is a running instance of an image. A registry, like Docker Hub, stores images so you can pull them. A volume holds data outside a container’s lifecycle. A Compose file describes several containers that work together. A tag is a label on an image version. A stage is one FROM block in a multi-stage Dockerfile. Knowing these seven terms makes the documentation far easier to read.
Picking a Base Image
Docker’s older tutorials use general images such as python or node. The current official Python guide uses Docker Hardened Images, with a development variant for building and a minimal variant for running. A smaller runtime image has fewer packages that can contain vulnerabilities, which is the stated rationale for hardened images. The pages reviewed do not publish size comparisons, so compare image sizes on your own project with docker images before deciding.
Frequently Asked Questions
Is Docker free for developers?
Docker Desktop is free for personal use and for small businesses under 250 employees and $10 million in revenue. Docker Engine is open source.
What is a Dockerfile?
A text file of instructions for building an image, such as the one above.
Do I still need the version line in docker-compose?
No. Docker says it is obsolete and triggers a warning.
What are Docker Hardened Images?
Minimal, hardened base images that Docker made free and open source under Apache 2.0 on December 17, 2025.
How do I keep my database data?
Use a volume so data survives after the container is removed.
References and Sources
Docker Docs, “What is a container?”: https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/
Docker, “Pricing FAQ”: https://www.docker.com/pricing/faq/
Docker, “Pricing”: https://www.docker.com/pricing/
Docker Docs, “Docker Desktop release notes”: https://docs.docker.com/desktop/release-notes/
Docker Docs, “Docker Engine release notes”: https://docs.docker.com/engine/release-notes/
Docker Docs, “Pull usage and limits”: https://docs.docker.com/docker-hub/usage/pulls/
Docker, “Docker Makes Hardened Images Free, Open and Transparent for Everyone”: https://www.docker.com/press-release/docker-makes-hardened-images-free-open-and-transparent-for-everyone/
Docker Docs, “Writing a Dockerfile”: https://docs.docker.com/get-started/docker-concepts/building-images/writing-a-dockerfile/
Docker Docs, “Containerize a Python application”: https://docs.docker.com/guides/python/containerize/
Docker Docs, “Multi-stage builds”: https://docs.docker.com/build/building/multi-stage/
Docker Docs, “Persisting container data”: https://docs.docker.com/get-started/docker-concepts/running-containers/persisting-container-data/
Docker Docs, “Version and name top-level elements”: https://docs.docker.com/reference/compose-file/version-and-name/
Podman, “Podman”: https://podman.io/
OrbStack, “Pricing”: https://orbstack.dev/pricing
About The Author
