Glossary and cheat sheet · Docker

Glossary

Term	Meaning
Apptainer	Rootless container runtime for HPC clusters; runs single-file `.sif` images, built from Docker images
Bind mount	A host directory mounted into a container at a path you choose
Build context	The directory sent to the builder; `COPY` can only read from it
BuildKit	Docker’s build engine: parallel stages, cache, secret and SSH mounts
buildx	The CLI front end for BuildKit, including multi-platform builds
CDI	Container Device Interface: a vendor-neutral way to describe devices such as GPUs to runtimes
cgroup	Kernel mechanism that limits and accounts CPU, memory, PIDs and I/O
Compose	Declarative multi-container definition for one host
containerd	Container daemon that manages images and container lifecycles; used by Docker and Kubernetes
Context (Docker)	A named target engine for the CLI, local or remote over SSH
Copy-on-write	Modifying a lower-layer file first copies it whole into the writable layer
Digest	SHA-256 hash naming exact content; immutable
Entrypoint	The executable an image always runs; `CMD` supplies its default arguments
Exec form	JSON-array syntax for `CMD` and `ENTRYPOINT`; no shell, your process is PID 1
Image index	Manifest list mapping platforms (amd64, arm64) to per-platform manifests
Layer	Immutable filesystem diff produced by a build step
Manifest	List of an image’s config and layers for one platform
Namespace	Kernel feature giving a process a private view of one resource: PIDs, mounts, network and more
NVIDIA Container Toolkit	Host software that injects GPU devices and driver libraries into containers
OCI	Open Container Initiative: standards for image format, runtime and registries
OverlayFS	Union filesystem stacking read-only layers under a writable layer
PID 1	The container’s main process; receives stop signals and must handle them
Registry	Server storing and serving images: Docker Hub, GHCR, ECR, NGC
runc	Low-level OCI runtime that creates the container and executes your process
Shim	Per-container helper process that holds stdio and exit status, decoupling containers from the daemon
`/dev/shm`	Shared-memory filesystem; 64 MB by default in containers, too small for multi-worker data loading
Tag	Mutable, human-readable image name such as `1.4.0` or `latest`
Volume	Docker-managed persistent storage that outlives containers
Whiteout	Marker in an upper layer that hides a file from lower layers

Command cheat sheet

# Images
docker build -t app:1.0 .
docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/you/app:1.0 --push .
docker pull python:3.12-slim
docker image ls
docker history app:1.0
docker tag app:1.0 ghcr.io/you/app:1.0 && docker push ghcr.io/you/app:1.0

# Containers
docker run -d --name api -p 127.0.0.1:8000:8000 --env-file .env app:1.0
docker run --rm -it --entrypoint sh app:1.0
docker ps -a
docker logs -f --tail 200 api
docker exec -it api bash
docker inspect -f '{{.State.ExitCode}} {{.State.OOMKilled}}' api
docker stats
docker stop api && docker rm api

# Storage and networks
docker volume create hf-cache && docker volume ls
docker network create ai-net && docker network inspect ai-net

# GPUs
docker run --rm --gpus all --shm-size=16g <image> nvidia-smi

# Compose
docker compose up -d --build
docker compose logs -f api
docker compose run --rm api python -m src.ingest
docker compose config
docker compose down        # add -v to delete volumes too

# Remote engines
docker context create gpu-box --docker "host=ssh://user@host"
docker context use gpu-box

# Cleanup
docker system df
docker builder prune
docker system prune -a

Where to go deeper

Docker documentation: the reference for every command, Dockerfile instruction and Compose key.
NVIDIA Container Toolkit documentation: installation, CDI and GPU selection.
Open Container Initiative: the image, runtime and distribution specifications.
namespaces(7) and cgroups(7) man pages: the kernel primitives in full detail.
Apptainer documentation: running your images on HPC clusters.