</span></code></pre></div><p>That's it, your first docker container. It pre-supposes you have <ahref=https://github.com/IronicBadger/til/blob/master/docker/yum-apt-repos-docker.md>docker installed</a> but that's all it takes to run a container. You didn't need to know anything about installed what that app needed to run - this is the key benefit. <code>hello-world</code> is a simple example but imagine you have a complex application with a large number of dependencies and it is tied to a specific version of Python or Java. Then imagine you have a second app again tied to a specific, but different, version of Java or Python. Now you have to try and ensure these two (often conflicting) versions sit on the same host and play nice. In the world of containers these two versions can operate in complete isolation from one another. Bliss.</p><h2id=key-terminology>Key Terminology<aclass=headerlinkhref=#key-terminologytitle="Permanent link">¶</a></h2><p>There are a few terms you might find useful to understand when working with containers:</p><ul><li><strong>docker</strong> - the first, and most popular, container runtime - it sits as an abstraction layer between the kernels features such as cgroups or namespaces and running applications</li><li><strong>container</strong> - a sandboxed process isolated in memory and running instance of an image</li><li><strong>image</strong> - a pre-built filesystem in a format ready to be understood by a container runtime (usually docker)</li><li><strong>volume</strong> - use volumes to persist data outside of the containers sandboxed filesystem</li><li><strong>environment</strong> - a way of configuring the sandboxed environment your container runs in</li></ul><h2id=key-concepts>Key Concepts<aclass=headerlinkhref=#key-conceptstitle="Permanent link">¶</a></h2><p>Containers are completely sandboxed environments by the Linux kernel. It may help you to think of them <em>somewhat</em> like a small VM however in practice this is largely false. The Linux kernel controls access to various system resources utilising control groups (cgroups). We rely on docker to translate these complex concepts into simple ones that users can understand and consume.</p><p>By default a running container has absolutely no context of the world around it. Out the box you cannot connect from the outside world to the running webservers on ports 80 and 443 below. To allow entry to the sandbox from the outside world we must explicitly allow entry using the <code>-p</code> flag.</p><divclass="language-shell highlight"><pre><span></span><code><spanid=__span-1-1><aid=__codelineno-1-1name=__codelineno-1-1href=#__codelineno-1-1></a>docker<spanclass=w></span>run<spanclass=w></span>-d<spanclass=w></span>--name<spanclass=o>=</span>letsencrypt<spanclass=w></span>-p<spanclass=w></span><spanclass=m>80</span>:80<spanclass=w></span>-p<spanclass=w></span><spanclass=m>443</span>:443<spanclass=w></span>linuxserver/letsencrypt
