DevOps
Docker
Packages an app with its exact dependencies into an image that runs identically anywhere as an isolated container, killing 'works on my machine'. Layers make builds and deploys fast and reproducible. Do it well with small base images, multi-stage builds, a non-root user, and absolutely no secrets baked into the layers.
Purpose
Docker packages an application with its exact dependencies — runtime, libraries, OS userland — into an image that runs identically on any machine as an isolated container. It ended 'works on my machine': the artifact you test is byte-for-byte the artifact you ship.
When to Use It
Consistent dev environments, CI builds, and production deployment — one image promoted through every stage. Docker Compose orchestrates multi-service setups locally (app, database, cache in one file), and containers are the unit Kubernetes and most PaaS platforms run.
Trade-offs
Containers share the host kernel — lighter than VMs but a weaker isolation boundary. Image bloat and drift are the practical annoyances: careless Dockerfiles produce gigabyte images with security patches missing. There is also a real learning curve around layers, caching and networking.
Implementation
Write Dockerfiles that exploit layer caching: copy dependency manifests and install first, copy source last. Use small base images and multi-stage builds to keep runtime images lean; run as a non-root user; never bake secrets into layers (they persist in history). Tag images immutably and scan them for vulnerabilities.