Containerization with Docker — Hinglish notes

5.3.8 · AI-ML › MLOps & Deployment

Containerization KYA hai?

Image kaise build hoti hai: layers (derive karo)

Layers kyun? Docker ek image ek instruction at a time build karta hai. Har instruction (FROM, RUN, COPY, …) ek naya read-only layer produce karta hai jo pichhle layer ke upar stack hota hai (ek union filesystem). Is design se do bade fayde milte hain:

Caching — agar kisi layer ki instruction aur uske inputs unchanged hain, toh Docker cached layer reuse karta hai rebuild karne ki jagah. Rebuilds minutes se seconds mein aa jaate hain.
Sharing — layers hash se content-addressed hote hain, isliye do images jo ek base share karti hain woh use disk/registry pe sirf ek baar store karti hain.

Canonical ML Dockerfile (first principles se build kiya)

# 1. Base layer: ek slim OS + Python. Chhota base = chhoti image, kam attack surface.
FROM python:3.11-slim
 
# 2. Working directory set karo (baad ke saare paths iske relative honge).
WORKDIR /app
 
# 3. SIRF dependency manifest pehle copy karo — yeh layer rarely change hoti hai.
COPY requirements.txt .
 
# 4. Deps install karo. --no-cache-dir layer ko chhota rakhta hai.
RUN pip install --no-cache-dir -r requirements.txt
 
# 5. AB source code copy karo — yeh har commit pe change hota hai, isliye LAST mein jaata hai.
COPY . .
 
# 6. Woh port document karo jis par app listen karta hai (metadata, firewall rule nahi).
EXPOSE 8000
 
# 7. Container start hone par run hone wala default process.
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]

Worked example Build → Run → Push (har step justified)

docker build -t myapp:1.0 .        # Kyun: Dockerfile se image banao, tagged.
docker run -p 8080:8000 myapp:1.0  # Kyun: -p host:container ports bahar map karta hai.
docker push registry/myapp:1.0     # Kyun: registry mein store karo taaki cloud pull kar sake.

8080:8000 kyun? Left = tumhari machine ka port; right = container ke andar EXPOSEd port. localhost:8080 ka traffic andar forward hota hai.

Common mistakes (Steel-manned)

Active recall

Recall Quick self-test (expand se pehle jawab do)

Containers VMs se zyada fast kyun start hote hain?
Pehle kaun si line aani chahiye: COPY requirements.txt ya COPY . .? Kyun?
Image aur container mein kya fark hai?
Kya EXPOSE port publish karta hai? Kya karta hai?
Data kahan jaata hai agar tum chahte ho ki woh container deletion ke baad survive kare?

Answers: 1) Woh host kernel share karte hain — boot karne ke liye koi guest OS nahi. 2) requirements.txt pehle, taaki pip-install layer code edits ke across cached rahe. 3) Image = frozen template; container = uska running instance. 4) Nahi — EXPOSE metadata hai; run time par -p publish karta hai. 5) Ek mounted volume.

Recall Feynman: 12-saal ke bachche ko explain karo

Socho tumne ghar pe ek cake bake kiya aur woh perfect tha, lekin jab tumhare dost ne wahi recipe try ki toh unka oven alag tha aur woh bigad gaya. Docker aise hai jaise cake aur ek mini kitchen ko ek sealed lunchbox mein rakh do — same oven, same ingredients, same sab kuch — toh chahe kisi ke bhi ghar pe kholo, wahi taste aata hai. Recipe card Dockerfile hai, sealed lunchbox image hai, aur jab tum ek kholke khaane lagte ho woh container hai. Lunchbox ko sau baar copy kar sakte ho aur har ek same hoga.

Connections

Kubernetes Orchestration — bahut saare containers schedule aur scale karta hai.
CI-CD Pipelines — har commit par automatically images build aur push karta hai.
Model Serving with FastAPI — app:app jo tumhara CMD typically run karta hai.
Container Registries — Docker Hub / ECR / GCR pushed images store karte hain.
Virtual Environments (venv, conda) — Python-level isolation; Docker OS-level hai.
Reproducibility in ML — pinned images = deterministic deployments.

Dockerfile kya hai?

Plain-text recipe of instructions jo Docker image build karne ke liye use hoti hai.

Docker image kya hai?

Ek frozen, read-only, layered template (filesystem + metadata) jo Dockerfile se produce hoti hai.

Docker container kya hai?

Image ka ek running, isolated instance (image aur container ka relationship class aur object jaisa hai).

Containers VMs se halke kyun hain?

Woh namespaces/cgroups ke zariye host OS kernel share karte hain, poora guest OS ship karne ki jagah.

Containers ko isolation kon se kernel features dete hain?

namespaces (process kya dekh sakta hai) aur cgroups (kitna use kar sakta hai).

Dockerfile mein source code se pehle requirements.txt kyun copy karte hain?

Taaki mehenga pip-install layer cached rahe aur har code change par rebuild na ho.

Image ki har layer kya represent karti hai?

Ek single Dockerfile instruction se produce hone wala filesystem change, union filesystem ke zariye stack kiya hua.

n layers mein se layer k change hone par rebuild cost?

Layer k se n tak ke costs ka sum (woh layer aur uske baad ki saari layers rebuild karni padti hain).

Kya EXPOSE host ko port publish karta hai?

Nahi — yeh metadata/documentation hai; docker run par -p host:container actually publish karta hai.

docker run -p 8080:8000 ka matlab?

Host port 8080 ko container port 8000 se map karo (host:container).

CMD aur ENTRYPOINT mein fark?

ENTRYPOINT fixed executable set karta hai; CMD default, overridable arguments set karta hai.

Production mein latest tag kyun avoid karo?

Yeh mutable hai aur silently alag image ki taraf point kar sakta hai, reproducibility todke; version/SHA pin karo.

Container ke baad data persist kaise karo?

-v host:container se volume mount karo; container ki writable layer ephemeral hai.

python:3.11-slim ko python:3.11 se prefer kyun karo?

Chhoti image, faster pulls, aur kam attack surface (fewer unused build tools).

Current dir se myapp:1.0 tagged image build karne ka command?

docker build -t myapp:1.0 .