A container image packages an application and its dependencies; a container is a running instance created from that image. The distinction helps explain build-time contents versus runtime behavior.
Build a clear image
A Dockerfile describes build steps. Keep the image focused, review the base image, and avoid copying credentials or local development files into layers. Use meaningful tags and follow the team's image provenance process.
Configure at runtime
Supply environment-specific values at runtime through an approved mechanism. Do not store secrets in the Dockerfile, image, or public repository. Volumes support persistent data but require a backup and recovery plan.
Understand networking and lifecycle
Containers communicate through configured networks and still use host resources. Inspect health, logs, resource usage, and exposed ports. Stop and remove practice resources when finished.
Use a sandbox and confirm costs and permissions before pulling or publishing images to a shared registry.