Data and networking

Both problems come from the same idea: a container is its own small, separate machine. It has its own disk, which is thrown away with it, and its own network, with its own localhost. This lesson is about reaching outside both.

Where a container’s files go

An image is read-only. When a container starts, Docker gives it a thin writable layer on top of the image. Everything the container writes lands there: logs, uploads, a database’s files.

That layer belongs to that one container. Stopping the container keeps it. Removing the container deletes it. A new container from the same image starts with an empty layer again.

Most of the time that’s what you want: a container you can throw away and replace. But some data must outlive the container. Docker has two ways to keep it:

A volume or bind mount is attached at a folder inside the container, called its mount point. MySQL always writes to /var/lib/mysql. Mount a volume there, and MySQL’s files go into the volume without MySQL knowing anything changed.

Two ways to write it

docker run accepts volumes and bind mounts in two styles. They do the same thing:

--mount is longer but harder to get wrong. With -v, if the left side doesn’t look like a path, Docker quietly treats it as a volume name. With --mount type=bind, a path that doesn’t exist is an error, which is what you want.

Every container has its own network

Each container gets its own network card, its own IP address, and its own localhost. Inside a container, localhost means that container, and nothing else.

Publishing ports

-p takes the host’s port first, then the container’s:

Containers talking to each other on the same network don’t need -p at all. Publishing is only for reaching a container from outside Docker. That’s why QuickCart’s database will have no -p: only the app needs to reach it.

Networks and names

Docker starts every container on a network called bridge unless you say otherwise. Containers on it can reach each other only by IP address, and addresses change every time a container is recreated.

A network you create is also a bridge network, with one important extra: built-in DNS. Every container on it can reach the others by name.

This is the same idea as security groups: who can reach whom is decided by the network around the app, not by the app.

Docker Compose: all of it in one file

Starting a database and an app by hand takes a network, a volume, and two long docker run commands, typed in the right order. Docker Compose describes all of that in one file, compose.yaml, and starts it with one command.

Compose also creates a network for the project, and each service name becomes a hostname on it. A service called db is reachable as db.

In the cloud

On your computer, a volume is a folder Docker manages on your disk. In production there’s no laptop, and containers move between machines, so QuickCart doesn’t keep its database in a container at all. It uses a managed database, RDS, and files go to S3. Containers on ECS and Kubernetes get their own networking too, covered in ECS on Fargate. What you learn here is the local version of the same ideas.

Below is a MySQL container on your machine. Save a few orders, remove the container, and start a new one. Then switch to In a named volume and do exactly the same.

What to notice: MySQL behaved identically both times. It wrote to the same folder, /var/lib/mysql. The only difference was whether that folder was part of the container or a volume mounted into it, and that decided whether the orders survived.

Free — everything runs on your own computer.

You’ll lose a file on purpose, keep one with a volume, look into your computer from a container, connect two containers by name, and then run QuickCart’s app with MySQL using Compose. About 30 minutes.

You need Docker running, and the order-service folder from Writing a Dockerfile. Open a terminal in that folder.

1. Watch a file disappear

   Start a container that writes a file and finishes:

   TerminalCopy

   docker run --name scratch python:3.12-slim sh -c "echo hello > /note.txt"

   Part	What it means
   docker run --name scratch	start a container called scratch. No --rm, so it’s kept after it finishes
   python:3.12-slim	the image; you already have it from the last lesson
   sh -c "…"	run the text in quotes with the container’s shell
   echo hello > /note.txt	inside the container: write hello into the file /note.txt. The > sends what echo prints into the file

   It prints nothing and finishes straight away. The file is in the container’s writable layer. Now remove the container:

   TerminalCopy

   docker rm scratch

   Part	What it means
   docker rm scratch	delete the container, and its writable layer with it

   You should see

   scratch

   Start a new container from the same image and look for the file:

   TerminalCopy

   docker run --rm python:3.12-slim cat /note.txt

   Part	What it means
   --rm	delete this container as soon as it finishes
   cat /note.txt	print the file

   You should see

   cat: /note.txt: No such file or directory

   The file went with the container. The image never had it.

2. Keep it with a named volume

   TerminalCopy

   docker volume create notes

   Part	What it means
   docker volume create	make a volume
   notes	its name

   You should see

   notes

   Write the file into the volume this time:

   TerminalCopy

   docker run --rm -v notes:/data python:3.12-slim sh -c "echo hello > /data/note.txt"

   Part	What it means
   -v notes:/data	mount the volume notes at /data inside the container
   echo hello > /data/note.txt	write the file inside /data, which is the volume

   That container is already gone, because of --rm. Start a different one with the same volume:

   TerminalCopy

   docker run --rm -v notes:/data python:3.12-slim cat /data/note.txt

   Part	What it means
   -v notes:/data	a brand-new container, given the same volume
   cat /data/note.txt	print the file from the volume

   You should see

   hello

   A new container read what an old, deleted one wrote.

3. Look into your computer with a bind mount

   A bind mount needs the full path of a folder. Ask the terminal where you are:

   TerminalCopy

   pwd

   Part	What it means
   pwd	print working directory: the full path of the folder you’re in

   Something like

   /home/maya/order-service

   Copy what yours prints, and use it in place of FULL_PATH:

   TerminalCopy

   docker run --rm --mount type=bind,source=FULL_PATH,target=/code,readonly python:3.12-slim ls /code

   Part	What it means
   --mount type=bind	show a folder from your computer inside the container
   source=FULL_PATH	which folder: the path pwd printed
   target=/code	where it appears inside the container
   readonly	the container can read the folder but not change it
   ls /code	list what’s there

   You should see

   Your folder’s files: Dockerfile, app.py, requirements.txt, and any other files from the last lesson. The container is looking straight at your computer’s folder. Nothing was copied.

4. Connect two containers by name

   Build the order service image again. You removed it at the end of the last lesson:

   TerminalCopy

   docker build -t order-service:v1 .

   Part	What it means
   docker build -t order-service:v1 .	build the image from the Dockerfile in this folder, named order-service:v1

   You should see

   The build finishes with a naming to docker.io/library/order-service:v1 line.

   Create a network:

   TerminalCopy

   docker network create quickcart

   Part	What it means
   docker network create	make a new bridge network, with its own DNS
   quickcart	its name

   You should see

   A long ID: the new network’s.

   Start the order service on it. There’s no -p, so your computer can’t reach it, only containers on the network can:

   TerminalCopy

   docker run -d --name orders --network quickcart order-service:v1

   Part	What it means
   -d --name orders	run it in the background, called orders
   --network quickcart	connect it to the quickcart network instead of the default one

   Now start a second container on the same network, running curl, and call the first one by its name:

   TerminalCopy

   docker run --rm --network quickcart curlimages/curl -sS http://orders:8080/health

   Part	What it means
   --network quickcart	put this container on the same network
   curlimages/curl	a tiny image that contains only curl. Docker downloads it the first time
   -sS	silent, but still show an error if there is one
   http://orders:8080/health	the container called orders, port 8080, page /health

   You should see

   {"status":"ok","version":"v1"}

   Try the same from a container on the default network:

   TerminalCopy

   docker run --rm curlimages/curl -sS --max-time 3 http://orders:8080/health

   Part	What it means
   no --network	this container goes on the default bridge network
   --max-time 3	give up after 3 seconds

   You should see

   curl: (6) Could not resolve host: orders

   It can’t even find the name. It’s on a different network, with no DNS for orders.

   Remove the container before moving on, so it doesn’t hold the name:

   TerminalCopy

   docker rm -f orders

   Part	What it means
   docker rm -f	stop and delete the container in one step

   You should see

   orders

5. Describe the app and MySQL in compose.yaml

   In the order-service folder, create compose.yaml:

   compose.yamlCopy

   services:
     app:
       build: .
       image: order-service:v1
       ports:
         - "8080:8080"
       depends_on:
         db:
           condition: service_healthy
   
     db:
       image: mysql:8.4
       environment:
         MYSQL_ROOT_PASSWORD: local-root-only
         MYSQL_DATABASE: quickcart
         MYSQL_USER: quickcart
         MYSQL_PASSWORD: local-dev-only
       volumes:
         - db-data:/var/lib/mysql
       healthcheck:
         test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1"]
         interval: 5s
         timeout: 3s
         retries: 20
         start_period: 30s
   
   volumes:
     db-data:

   Line	What it does	If you leave it out
   services:	The containers in this project. Each name becomes a hostname on the project’s network	Nothing to run
   app: → build: .	Build the image from the Dockerfile in this folder	Compose would need an image that already exists
   image: order-service:v1	The name to give that image	Compose makes up a name from the folder and service
   ports: "8080:8080"	Publish port 8080 on your computer to the app. Quoted, because YAML can misread some number pairs with a colon	You couldn’t reach the app from your computer
   depends_on: → condition: service_healthy	Start the app only once the database’s health check passes	The app might start before MySQL is ready to accept connections
   db: → image: mysql:8.4	MySQL 8.4, a long-term support release	Required
   environment:	Settings the MySQL image reads the first time it starts with an empty data folder: the root password, and a database and user to create	MySQL refuses to start without a root password setting
   volumes: - db-data:/var/lib/mysql	Mount the named volume db-data where MySQL keeps its files	The data lives in the writable layer and dies with the container
   healthcheck: → test:	Ask MySQL “are you alive?” over the network with mysqladmin ping. It answers without a password	service_healthy would have nothing to wait for
   interval, timeout, retries, start_period	Check every 5 seconds, wait 3 seconds for an answer, allow 20 failures in a row, and ignore failures in the first 30 seconds while MySQL sets itself up	Docker’s defaults check every 30 seconds, which makes startup slow
   volumes: db-data: at the end	Declare the named volume, so Compose creates it	Compose stops with an error: the service refers to an undefined volume

   The database has no ports: line. Only the app can reach it, over the project’s network, by the name db.

6. Start it and prove the names work

   TerminalCopy

   docker compose up -d --wait

   Part	What it means
   docker compose up	create the network and volume, build the app image if needed, and start both services
   -d	in the background
   --wait	don’t return until the services are running and healthy

   You should see

   A short list of what was created: a network called order-service_default, a volume called order-service_db-data, and containers called order-service-db-1 and order-service-app-1, ending with both Healthy or Started. Compose names things after your folder. The first time, it downloads MySQL, which takes a minute.

   The app answers on your computer, as before:

   TerminalCopy

   curl localhost:8080/health

   Part	What it means
   curl localhost:8080/health	fetch the health page through the published port

   You should see

   {"status":"ok","version":"v1"}

   Now ask the app container what the name db means:

   TerminalCopy

   docker compose exec app python -c "import socket; print(socket.gethostbyname('db'))"

   Part	What it means
   docker compose exec app	run a command inside the running app service
   python -c "…"	run a one-line Python program
   socket.gethostbyname('db')	look up the name db the way the app would, and print the address it finds

   An address like

   172.18.0.2

   The name db means the database container, found through Compose’s network. That’s the address the app would use instead of localhost.

7. Save an order, then recreate everything

   Create a table and save one order, with the MySQL client that’s inside the db container:

   TerminalCopy

   docker compose exec db mysql -uquickcart -plocal-dev-only quickcart -e "CREATE TABLE orders (id INT PRIMARY KEY, item VARCHAR(50)); INSERT INTO orders VALUES (1, 'pad thai');"

   Part	What it means
   docker compose exec db	run a command inside the db service
   mysql	the MySQL command-line client
   -uquickcart -plocal-dev-only	log in as user quickcart with its password. No space after -u or -p
   quickcart	the database to use
   -e "…"	run this SQL and exit: create a table, then add one row

   You should see

   mysql: [Warning] Using a password on the command line interface can be insecure.

   That warning is MySQL reminding you that a password typed in a command is visible to anyone who can see your command history. Fine for a local lab.

   Now remove both containers and the network, but not the volume:

   TerminalCopy

   docker compose down

   Part	What it means
   docker compose down	stop and remove the project’s containers and network. Named volumes are kept

   You should see

   Both containers and the network listed as Removed. The volume isn’t mentioned: it’s still there.

   Start everything again. These are brand-new containers:

   TerminalCopy

   docker compose up -d --wait

   Part	What it means
   docker compose up -d --wait	create fresh containers and wait until they’re healthy

   Ask the new database for the order:

   TerminalCopy

   docker compose exec db mysql -uquickcart -plocal-dev-only quickcart -e "SELECT * FROM orders;"

   Part	What it means
   -e "SELECT * FROM orders;"	print every row in the orders table

   You should see

   mysql: [Warning] Using a password on the command line interface can be insecure.
   +----+----------+
   | id | item     |
   +----+----------+
   |  1 | pad thai |
   +----+----------+

   The containers are new; the order isn’t. The new MySQL found its files in the volume.

8. Clean-up step: Clean up

   Remove the Compose project, including its volume. This deletes the test order for good:

   TerminalCopy

   docker compose down -v

   Part	What it means
   docker compose down	remove the containers and the network
   -v	also remove the named volumes in compose.yaml: here, db-data and everything in it

   You should see

   The containers, the network and the volume order-service_db-data, all listed as Removed.

   Remove the network and volume from the earlier steps:

   TerminalCopy

   docker network rm quickcart

   Part	What it means
   docker network rm	delete a network. It must have no containers left on it

   You should see

   quickcart

   TerminalCopy

   docker volume rm notes

   Part	What it means
   docker volume rm	delete a volume, and every file in it

   You should see

   notes

   Last, remove the images you downloaded for this lab:

   TerminalCopy

   docker image rm mysql:8.4 curlimages/curl

   Part	What it means
   docker image rm	delete images from your computer
   mysql:8.4 curlimages/curl	the two images this lab downloaded

   You should see

   Untagged: and Deleted: lines for each. Keep order-service:v1 and your order-service folder: Storing images: ECR pushes that image to AWS.