Docker Guide for Admins

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

An image is a file you can point at

Docker on this desk is one image and, if you need it, one compose file for a lab. The Dockerfile generator and the compose generator draft text. The docker run builder drafts a command. None of them talk to a daemon. You read the draft before anything runs.

Pin a tag you can say next month. 'Latest' as the only record means you cannot rebuild today's lab. Write the tag beside the purpose. A digest is even better when you have one. The self-hosting guide is the longer compose story. This page is the first image.

A secret does not belong in the Dockerfile, the compose file, or the command line you paste into a ticket. prompt-for-this marks the gap. The real value stays in the store.

Privileged mode, the host network, and a mount of the engine's own socket are not defaults. Each one is a decision with a reason that survives a question. If you do not have that reason, the draft loses that line.

One image, one tag, a lab that stays local

Draft a Dockerfile for one lab process. Read the base image and pin it. Read every instruction. If a secret appears, remove it. Build is a later hour on a machine you administer, or a pipeline. This window can stop at the file.

If you need a run command, draft it and read the published ports. Prefer a bind to 127.0.0.1 for a lab user interface. A publish to every interface is a line you edit. The system desk's install note is how the engine got onto the host. You do not reinstall the engine here.

A compose file, if you draft one, has named volumes and a lab project name. You do not mount a production directory into a container to 'save a copy'. The volume is the data. The backup of that volume is a sentence you write, even if the job is later.

Kubernetes is a different guide. Do not convert this file into a cluster manifest in the same hour. One runtime is enough.

# Container note. Review before you run anything.
# Pin the tag. latest is not the record.
# Bind a lab port to 127.0.0.1 unless a ticket says otherwise.
# No privileged mode without a written reason.
# prompt-for-this is not a registry password.

A change you can finish

Running the container is a lab hour on a host you administer, after the file is reviewed.

Rollback is stopping that container and keeping the previous image tag. Do not delete the only volume to undo a test.

Draft one Dockerfile and pin the base.
Remove secrets and unread privileged lines.
Write the tag you will build.
Draft a run or compose only if you need it.
Bind lab ports to localhost.
Name the volume and the backup sentence.
Leave the cluster to the Kubernetes guide.

Mistakes that outlive the command

Docker for admins fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Running an unread draft.
latest as the only tag you recorded.
A password in the file or the ticket.
Publishing a lab port on every interface.
Privileged mode as a habit.
Mounting the engine socket into the container.
A production directory used as a lab volume.
Deleting a volume to reset.
Installing the engine and building an image in one confused hour.
Converting to Kubernetes before this file has run once.

Decisions to write down before the window

One decision for Docker for admins: One image is named. The base tag is pinned. No secret is in the file. Privileged mode is absent, or the reason is written. The socket is not mounted. A published lab port binds to localhost. The volume name is obvious. A backup sentence exists. The host is one you administer. Nothing ran during the writing hour, or the run was the separate lab hour. The self-hosting guide owns the longer compose. And one container is this window.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for Docker for admins. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. Docker for admins is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

Docker checks before a second image

Confirm this before you call the change done: The Dockerfile is in the ticket. The tag is not only latest. A person can say what the process does. No password is in the file. Lab ports are on localhost. Privileged is absent or explained. The volume is named. You did not mount a production path. The engine install is a different note. Kubernetes was not started. The host name matches the ticket. A second person read the published ports. The hostname in the prompt matches the hostname in the ticket for Docker for admins. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for Docker for admins happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: System: Ubuntu Server Docker Install Script Generator.