Container Lifecycle

Use docker run --device /dev/ttyACM0:/dev/ttyACM0. Docker creates that one device node inside the container and permits it in the container's device allow-list. --privileged works only by unlocking every host device at once, which is far too broad.

docker exec starts a new process inside a running container; exiting it leaves the container alone. docker attach connects your terminal to the container's existing main process (PID 1), so Ctrl+C sends SIGINT to that process and usually stops the container.

docker ps -a shows Exited (N) in the STATUS column, and docker inspect --format '{{.State.ExitCode}}' <container> gives the number. 0 means the main process finished successfully; any non-zero value means it failed — 1 is the generic "the application errored" code.

It tells Docker a command to run periodically inside the running container to test whether the app actually works. Exit 0 means healthy, 1 means unhealthy. The result shows in docker ps as (healthy), (unhealthy) or (starting) next to the container's uptime, with details in docker inspect.

Docker Engine supervises only PID 1. With one foreground process per container, the container's logs, exit code, restart policy and resource limits all describe that process; anything else running inside is governed by nothing.

no never restarts (the default). on-failure[:N] restarts only on a non-zero exit, at most N times. always restarts on any exit and after daemon start. unless-stopped is like always but stays down once you stopped it. Set with --restart; change with docker update --restart.

docker stop sends SIGTERM to the container's PID 1, waits a grace period (10 seconds by default, changed with -t), then sends SIGKILL if the process is still alive. docker kill skips the wait and sends SIGKILL immediately.

docker create makes a container from an image without starting it (state: created). docker start starts an existing container. docker run is create plus start in one step. Use create when you want to configure or copy files into a container, or pre-stage it, before it ever runs.

Docker Official Images are a curated set in Docker Hub's reserved library namespace, which is why they pull by a bare name like postgres. Verified Publisher and Sponsored OSS images come from an identity-checked vendor; everything else is unreviewed.

docker save archives an image with all its layers, tags and history, and docker load restores it unchanged. docker export dumps a container's filesystem as one flat tar; docker import turns that into a single-layer image with no history and no CMD or ENTRYPOINT.

docker logs only replays what the container's main process wrote to stdout and stderr, captured by the logging driver. Logs written to a file inside the container are invisible to it. The app must log to stdout/stderr, or the file must be symlinked to /dev/stdout.

When a process is terminated by a signal rather than exiting on its own, the reported status is 128 plus the signal number. 137 = 128 + 9 = SIGKILL (force kill, often an out-of-memory kill). 143 = 128 + 15 = SIGTERM (a polite stop request the process did not survive).

--interval is the wait between probe runs, --timeout is how long one probe may take before it counts as a failure, --retries is how many consecutive failures flip the state to unhealthy, and --start-period is an initial window where failures don't count — one success at any time marks the container healthy.

The supervisor becomes PID 1, so Docker only ever sees the supervisor. Stop signals pass through a second, nested timeout; a crashed program leaves the container reporting Up with the supervisor's exit code, so no restart policy fires.

--cpus=N is a hard cap — shorthand for --cpu-quota/--cpu-period (CFS bandwidth), e.g. 150000/100000 for 1.5 CPUs. --cpu-shares is only a relative weight that applies when the host is contended; idle CPU is still free to take. Throttling appears as nr_throttled/throttled_usec in the cgroup's cpu.stat.

The kernel first reclaims what it can; if that is not enough, the cgroup OOM killer SIGKILLs a process inside that container only. If the victim is PID 1 the container dies with exit code 137 and State.OOMKilled=true. --memory-swap sets the combined memory+swap ceiling; setting it equal to --memory disables swap.

Both restart the container on any exit. They differ only for a container you deliberately stopped: with always it comes back when the daemon restarts or the host reboots; with unless-stopped it stays down. In every other case they behave identically.

Shell form wraps the command in /bin/sh -c, so the shell is PID 1 and your app is a child. Docker signals PID 1 — the shell — which does not forward SIGTERM. Use exec form (CMD ["npm","start"]) or exec in the entrypoint script so the app is PID 1.

created, running, paused, restarting, removing, exited, dead. run/start move created or exited to running; stop/kill or the process ending move running to exited; pause/unpause toggle paused; rm moves through removing to gone. dead means partial removal failed and the container is unusable.

Through the environment variables the image documents. A service image's entrypoint script reads them at container start and writes the real configuration, so docker run -e POSTGRES_PASSWORD=... -e POSTGRES_DB=... configures it without a Dockerfile of your own.

137 only says "killed by SIGKILL". Check docker inspect --format '{{.State.OOMKilled}} {{.State.ExitCode}}' <container>: true means the kernel out-of-memory killer fired. If it is false, look for a stop that timed out into SIGKILL, a docker kill, or a host-level kill — using timestamps, daemon logs, and dmesg.

Docker Engine only reports health; it never restarts on it. Restart policies react to the main process exiting, and an unhealthy container hasn't exited. To act on it you need a consumer: an orchestrator, Compose dependency conditions, or your own watcher on the health_status event stream.

Modern JVMs read cgroup limits (container support is default-on since JDK 10, backported to 8u191) and default the heap to about 25% of the container limit. The kill comes from total process memory: heap plus metaspace, thread stacks, code cache, direct buffers and native allocations. Size with -XX:MaxRAMPercentage and leave real non-heap headroom.

The Linux kernel treats PID 1 specially: signals with no explicitly installed handler are discarded instead of applying their default action. On a host your process is not PID 1, so SIGTERM's default action (terminate) applies. As PID 1, no handler means nothing happens.

Run docker stats. It live-streams per-container CPU % (summed across cores, so it can exceed 100%), MEM USAGE / LIMIT and MEM %, NET I/O, BLOCK I/O and PIDS, read from each container's kernel cgroup counters. Add --no-stream for a single snapshot.

docker ps shows only running containers; docker ps -a shows all states. Narrow with --filter: status=exited, label=team=payments, name=api, ancestor=nginx:alpine. Add -q for IDs only and --format for custom columns.

docker commit freezes a container's writable layer as a new layer on top of its image and copies the container's runtime config into the new image. Nothing records how that state was produced, so the image cannot be rebuilt, reviewed or trusted.

--gpus only records a device request; a GPU-aware runtime must be installed on the host. The NVIDIA Container Toolkit's hook then creates /dev/nvidia* nodes in the container and mounts the host's driver libraries and nvidia-smi into it.

docker inspect dumps a container's full JSON state — exit code, OOMKilled flag, restart count, mounts, network, config — for the current or last run. docker events streams the daemon's real-time lifecycle events (create, start, die, kill, destroy, health_status) so you can watch it happen and correlate timings.