Debugging Docker Containers: Exec and Logs Commands Explained

Health checks in Docker containers are implemented using the 'HEALTHCHECK' instruction in the Dockerfile. This command allows containers to periodically check their own health status and report it to Docker. Containers that fail health checks can be automatically removed or restarted based on the restart policy configuration.

Docker Health Check is a monitoring feature that verifies whether a container or application inside a container is running healthily by periodically executing a command (typically an HTTP request via curl) and checking the response status code; status codes starting with 200 or 300 indicate healthy status, while codes starting with 400 or 500 indicate unhealthy status. The health check can be configured with parameters including interval (how often to run), timeout (how long to wait for response), retries (how many failed attempts before marking unhealthy), and start-period (grace period after container startup before health checks begin). Health checks can be implemented directly in Docker Run commands, within Dockerfile instructions, or through Docker Compose configuration files.

This tutorial demonstrates how to implement health checks for a PostgreSQL database container using Docker, including configuring the pg_isready command with parameters for interval, timeout, retries, and start period, and creating a Python function to wait for the container to become healthy before proceeding with migrations.

Health Check is a Docker feature that allows the container to monitor whether the application inside is actually running and responding, not just whether the process is alive. Without health checks, a container might appear running (process is alive) while the application is actually stuck in an infinite loop or not responding to requests. The HEALTHCHECK instruction specifies a command to run periodically (using --interval flag) that checks if the application is healthy. If the check fails, Docker marks the container as unhealthy, which is crucial for orchestration systems like Kubernetes to automatically restart failing containers.

Health checks in Docker containers allow orchestrators like Kubernetes or Docker Swarm to monitor container status. A healthy container continues running, while an unhealthy container can be automatically replaced. Health checks are configured using the HEALTHCHECK instruction in the Dockerfile, typically by running a command that verifies the application is responding correctly.

Docker Compose networks enable multiple containers to communicate with each other. By default, containers are isolated and cannot see each other. Define a custom network in docker-compose.yml, then assign services to that network. Containers on the same network can reach each other by container name, enabling services like web APIs to connect to database containers seamlessly.

When running applications with Docker Compose, a default network is automatically created. All containers join this network and can communicate with each other using their service names as hostnames. Docker uses an embedded DNS server that maps container names to IP addresses. Containers can ping each other by name because the DNS resolver inside each container queries this embedded DNS server. Port mappings allow external access to containers, while internal communication happens through the network without needing port mappings.

Running 'docker compose up' builds images and starts all containers defined in compose.yaml. Common issues include permission errors (resolved by running as administrator or using sudo), port conflicts (resolved by stopping or deleting containers using other ports), and missing configurations (like '--host' flag for development servers). Understanding how to debug these common problems is essential for successful Docker development. The compose.yaml file can be modified to fix these issues.

Docker Compose simplifies managing multiple containers by defining services in a docker-compose.yml file. Services declare images, ports, environment variables, and dependencies. Volumes declared outside services are shared across all services; volumes within services are specific to that service. The 'depends_on' field ensures services start in the correct order. For WordPress, define separate services for MySQL database and WordPress application, with volumes mounted for persistent wp-content themes and plugins. Run with docker-compose up -d for detached mode. This enables complex applications like WordPress with database, web server, and theme files all working together seamlessly.

This video tutorial covers essential Docker commands for container management, including running containers with 'docker run', executing commands inside running containers with 'docker exec', inspecting container details with 'docker inspect', monitoring resource usage with 'docker stats', stopping and starting containers, removing containers with 'docker rm' (including force removal with -f flag), managing images with 'docker images' and 'docker rmi', and enabling inter-container communication using the --link parameter.

Secure containerization requires multiple practices: (1) Use minimal base images like Alpine or Google's Distroless images to reduce attack surface; (2) Implement multi-stage builds separating build and production environments; (3) Never run containers as root user by specifying non-root users in Dockerfiles; (4) Never hardcode secrets in Dockerfiles—use build secrets or tools like AWS Secrets Manager; (5) Configure .dockerignore to exclude .git, node_modules, and sensitive files; (6) Regularly scan images using tools like Trivy, Snyk, or Docker Scout; (7) Apply runtime security limits in Docker Compose for memory, CPU, and processes.

This video presents 10 essential Docker container security best practices: (1) Keep host and Docker versions updated with latest patches; (2) Run containers and Docker Daemon as non-root users to prevent container escape attacks; (3) Use lightweight container images (10-100MB) with minimal components like Alpine OS; (4) Never store secrets in Docker files or compose files; (5) Limit long-term storage by using separate services like Amazon RDS; (6) Scan Docker files and dependencies for vulnerabilities using tools like Snyk; (7) Use secret managers like AWS Secret Manager or HashiCorp Vault for credential management; (8) Scan container images for vulnerabilities using Amazon Inspector or Clair; (9) Consider managed container services like AWS ECS/EKS for production environments; (10) Implement network security and follow CIS Docker Benchmark standards.

Always use Docker Scout to check Docker containers for CVEs and vulnerabilities before pulling or pushing them, as even popular containers with billions of downloads can contain critical security issues; Docker Scout analyzes the software bill of materials to identify vulnerabilities and provides recommended fixes for base images and dependencies, helping achieve 100% compliance with security best practices including non-root users and supply chain attestations.

Running Docker containers with root privileges creates significant security vulnerabilities. When the Docker socket is mapped into a container, attackers can easily execute privileged operations. The demonstration shows how to install curl and jq, pull images, and write files to the host's root directory. Files created as root inside the container appear as root on the host, enabling privilege escalation attacks. This illustrates why running containers as root is dangerous and why rootless alternatives like Podman are recommended.

Running containers as root user creates severe security vulnerabilities: attackers can create volumes for spam attacks, run hundreds of processes causing Denial of Service, and access the Docker daemon to compromise the entire host infrastructure. To fix this, add two commands to the Dockerfile: create a user with 'groupadd -r <username>' and 'useradd -r -g <username> <username>', then switch to this user with 'USER <username>' before the CMD instruction. This ensures containers run with limited privileges, preventing privilege escalation attacks while maintaining application functionality.