Docker without fear: run any self-hosted app in a container

Docker runs apps in containers: sealed boxes that hold an app and everything it needs, sharing your computer's power but not its files. That's why one command gives you the same app on Windows, a Mac, a Linux laptop or a £5 server. Four words do most of the work:

• Image: the recipe. A read-only package you download from a registry such as Docker Hub. Its name has two halves: louislam/uptime-kuma says who and what, and the tag after the colon, 2.5.5-slim, says which version.
• Container: a running copy of an image. Containers are disposable: you delete and recreate them all the time. Updating an app means throwing its container away and making a new one from a newer image.
• Volume: where the data lives. Storage that Docker manages outside the container, attached at a folder inside it. Delete the container and the volume stays. Forget the volume and your data dies with the container.
• Port: the door. An app listens on a port inside its container, and nothing outside can reach it until you publish that port. 127.0.0.1:3001:3001 reads as: on this computer's private address, port 3001, forward to port 3001 inside the container.

Three more names you'll see. Docker Engine is the background service that actually runs containers, and it runs natively on Linux. Docker Desktop is an app for Windows and Mac that runs Docker Engine inside a small built-in Linux machine and adds a dashboard. Docker Compose reads a compose.yaml file, so you write an app's settings down once instead of retyping a long command.