Docker Glossary from A to Z
Docker Glossary — 83 definitions
- All the terms defined in the 28 sections of the guide, listed in alphabetical order.
- Tip: press Ctrl + F to search for a term on this page.
- .dockerignore
- Lists files excluded from the build context (node_modules, .git, .env): fast builds, clean images.
- Adminer
- Lightweight web-based SQL admin console, handy in dev via Compose.
- ARG
- Variable available during the build only (--build-arg).
- Bind mount
- Host folder mounted as-is into the container (ideal for dev).
- Build
- Building an image from a Dockerfile and its context.
- Buildx
- The modern builder (cache, multi-platform).
- CMD
- Container startup command, executed on every run.
- Compose
- The tool that describes and runs multi-container applications (compose.yml).
- Build context
- The folder sent to the daemon for the build (the ".").
- Container
- Live, isolated instance of an image, with its own writable layer.
- COPY
- Copy files from the context into the image during the build.
- Layer
- Read-only stratum of an image, shared and cached.
- CVE
- Public reference of a known vulnerability.
- Daemon
- The dockerd service that actually builds and runs everything.
- DATABASE_URL
- Full connection URL passed as a variable (user:pass@host:port/db).
- Deployment (K8s)
- Object that maintains N identical Pods + rolling updates.
- DCA
- Docker Certified Associate: the certification this guide leads to.
- depends_on
- Startup order between Compose services (no readiness guarantee).
- Detached (-d)
- Background mode for long-running services.
- Docker Desktop
- All-in-one suite for Windows/macOS (engine + Compose + UI).
- Docker Engine
- The engine on Linux (daemon + CLI).
- Docker Hub
- The default public image registry.
- Dockerfile
- The text recipe of an image (FROM, COPY, RUN, CMD…).
- Down
- Stop + remove the stack's containers and network (volumes kept).
- Down -v
- Same + volume removal (deliberate reset).
- Dump
- Portable logical SQL export (pg_dump).
- ENV
- Runtime variable persisted in the container.
- Ephemeral
- Dies with the container (internal files not mounted).
- Exec
- Run a command inside a living container.
- EXPOSE
- Internally declared port, without publishing.
- Front service
- The only published service (proxy/web), entry point.
- GHCR
- GitHub Container Registry, tied to repositories and CI.
- Healthcheck
- Periodic test proving a service's real health.
- hello-world
- Minimal test image validating the installation.
- history
- Layer-by-layer breakdown of an image (weight).
- Image
- Immutable, versioned template from which containers are born.
- Inspect
- Full JSON record of a container/image/network/volume.
- Interactive (-it)
- Terminal attached to the container (one-off tools).
- kind
- Kubernetes-in-Docker: local cluster for learning.
- latest
- Moving tag to the newest version (dev OK, prod no).
- Logs
- Journal captured by the daemon (read with -f, --tail).
- Managed (cluster)
- Cluster operated by a cloud provider (GKE/EKS/AKS).
- Manager / worker
- Swarm cluster driver / executor.
- Read-only mount
- Volume mounted read-only (:ro).
- Multi-stage
- Several FROM: only the last stage is shipped.
- Namespace
- Account/org prefix of the image (account/app).
- Node
- One machine of a cluster.
- Orphan
- Volume/project abandoned after renaming.
- Pipeline
- Automated chain: test → build → push → deploy.
- Pod
- Smallest K8s unit: 1+ co-located containers.
- Host:container port
- -p left:right: machine to isolated container.
- Profile (Compose)
- Opt-in group of services (--profile).
- Prune
- Cleanup of unused resources (with caution).
- Pull / push
- Pull from / publish to a registry.
- Replica
- Distributed copy of an orchestrated service.
- Registry
- Store of versioned images (Hub, GHCR, private).
- Tested restore
- Replay of a backup onto a fresh volume + verification.
- Restart policy
- Auto-restart (no, on-failure, always, unless-stopped).
- Retry
- Reconnect loop at startup (database not ready).
- Reverse proxy
- Front end routing by host to internal services.
- Rolling update
- Zero-downtime update, replica by replica.
- RUN
- Instruction executed during the build (frozen as a layer).
- Scale
- Adjust the number of replicas.
- Scout / Trivy
- Image vulnerability scanners.
- Secret
- Password/key/token: never in the image nor in git.
- Segmentation
- Networks per function (front/back).
- Service (Compose)
- Container described in compose.yml.
- Service (K8s)
- Stable address in front of moving Pods.
- Service (Swarm)
- Orchestrated unit (name, replicas, update).
- SHA
- Commit fingerprint, exact traceability tag.
- Snapshot
- Raw archive of a volume (tar).
- Stack
- Deployed Compose (Compose or Swarm).
- Override (-f)
- File modifying the base compose.
- Swarm
- Orchestrator built into Docker (simple multi-host).
- Tag
- Version of an image (1.2.0 immutable, latest moving).
- Immutable tag
- Frozen version never rewritten (prod).
- TLS
- HTTPS encryption (certificates).
- Token
- Limited, revocable access token (registries, CI).
- Up
- Create + start the whole Compose stack.
- USER
- Non-root runtime user in the Dockerfile.
- Named volume
- Persistent Docker space outside containers.
- WORKDIR
- Internal working directory of build/run.
- YAML
- Indented format of compose.yml (spaces, never tabs).