Docker - Package Your Code So It Actually Runs Everywhere

Here's the thing about Docker: it solved the most annoying problem in software development. You know how your Node.js app works perfectly on your MacBook but crashes immediately on the staging server because it's running Ubuntu 22.04 with a different version of everything? Docker packages your app with the exact versions of everything it needs, so it runs the same everywhere.

The Real Problem Docker Solves

Before Docker, deploying software was a fucking nightmare. You'd spend hours debugging why your app worked locally but failed in production. Different Python versions, missing libraries, conflicting dependencies - it was endless.

I've personally spent entire nights troubleshooting deployment issues that turned out to be because prod was running Python 3.8.10 while my local machine had 3.9.7. Docker eliminates this by packaging your code with the exact runtime it needs.

Containers share the host kernel but isolate everything else. Your app thinks it's running on its own machine, but it's actually just a process with fancy isolation. This means you get near-native performance without the overhead of full VMs.

How Docker Actually Works (The Technical Bits)

Docker uses Linux namespaces and cgroups to create isolated environments. The Docker daemon (dockerd) manages containers, images, networks, and volumes on your system.

Here's what happens when you run docker run:

1. Image Pull: Docker pulls the image from a registry (usually Docker Hub)
2. Container Creation: Creates a new container from that image
3. Filesystem Setup: Sets up a read-write layer on top of the image
4. Network Setup: Creates network interfaces and assigns IP addresses
5. Process Start: Runs your application as PID 1 inside the container

The genius is in the layered filesystem. Images are built in layers, so if you update just your application code, Docker only needs to rebuild that layer. Base OS layers get cached and reused across containers.

Production Reality Check

Docker Desktop is now a paid product - Pro plans cost $9/month, Team is $15/month per user. They made this change in December 2024, which pissed off a lot of developers who had been using it free.

In production, you're probably not running Docker Desktop anyway. You're using the Docker Engine directly on Linux servers, which is still free and open source.

Container networking can be a pain in the ass. The default bridge network works fine for simple cases, but once you need containers talking to each other reliably, you'll be diving into custom networks and service discovery.

Docker Hub rate limiting broke half the internet's CI pipelines in 2020. Free accounts get 100 pulls per 6 hours, which sounds like a lot until you're running integration tests that pull base images.

The Gotchas Nobody Tells You

Memory limits are enforced hard: Set --memory=512m and your container gets killed with exit code 137 when it tries to use 513MB. No warnings, just dead. Here's a real GitHub issue about this exact problem.

File permissions are a nightmare: Files created in containers often have weird ownership, especially with volume mounts. You'll spend time fighting with chown and understanding user namespaces.

Windows containers still suck: If you're on Windows and need to run Windows containers, prepare for pain. The tooling is years behind Linux containers. Windows Server 2022 containers are better but still janky.

BuildKit cache gets corrupted: Sometimes Docker's build cache gets corrupted and builds become slow as hell. docker builder prune -af usually fixes it, but you'll lose all cached layers. I've seen this happen after Docker Desktop updates especially.

Exit code 125 means your Dockerfile is fucked: When you see this error, it's usually a syntax error in your Dockerfile or you're trying to run a command that doesn't exist in the image.

Despite the frustrations, Docker solved a real problem. The "works on my machine" era is basically over. When you're debugging a production issue at 3 AM and the container runs exactly the same locally as it did in production, you'll remember why we put up with all this complexity.

Docker isn't just the container runtime anymore. They've built a whole ecosystem of tools, and some of them are actually useful. Others feel like money grabs.

Docker Desktop: Now With a Price Tag

Docker Desktop used to be free. Now it costs $9-24/month per user for companies, which pissed off a lot of people. But here's the thing - if you've ever tried to get Docker working reliably on Windows or macOS without it, you'll pay the money.

What actually works: The GUI for managing containers is decent. Volume management doesn't suck. The built-in Kubernetes cluster is handy for testing.

What's annoying: Docker Desktop randomly eats all your RAM. On M1/M2 Macs, it sometimes just stops working and you have to restart it. The Windows version requires WSL2, which has its own set of problems.

Docker Desktop 4.44 added AI model hosting in early 2025, which feels like they're jumping on the AI hype train. It's actually useful if you're doing local LLM development with models like Llama or Mistral, but most developers don't need it. The feature lets you run and manage AI models as containers, which is handy for testing but overkill for most web development.

Docker Hub: The Registry Everyone Uses

Docker Hub hosts pretty much every container image that matters. It's free for public images, but they added rate limiting that broke CI/CD pipelines worldwide.

Free accounts: 100 pulls per 6 hours. Sounds like a lot until your build pipeline pulls the same base images 20 times.

Paid plans: Start at $5/month for unlimited pulls. Worth it if you're running CI/CD that isn't constantly breaking.

The Docker Official Images are maintained by Docker and generally don't have obvious security holes. Use these unless you have a specific reason not to.

Docker Compose: Actually Useful

Docker Compose is probably Docker's best tool after the core container runtime. You define your multi-container app in a YAML file, run docker-compose up, and it just works.

version: '3.8'
services:
  web:
    build: .
    ports:
      - "3000:3000"
  db:
    image: postgres:15
    environment:
      POSTGRES_PASSWORD: password

What's great: Local development environments that mirror production. Everyone on your team gets the same setup.

What's frustrating: YAML syntax errors that don't tell you what's wrong. Environment variable handling that works differently than you expect. Network configuration that seems simple but has weird edge cases.

Docker Scout: Security Theater

Docker Scout scans your images for vulnerabilities. It'll find thousands of CVEs in your node_modules that you can't fix without breaking everything.

The reports are comprehensive but mostly useless. "Critical vulnerability in libssl" sounds scary until you realize it's only exploitable if someone has shell access to your container, at which point you have bigger problems.

Reality check: Use it to catch obvious problems (like using latest tags or running as root), but don't stress about every CVE.

Docker Build Cloud: Performance You Can Buy

Docker Build Cloud runs your builds on faster cloud instances. It actually works - builds that take 10 minutes locally finish in 2 minutes.

When it's worth it: Large codebases with complex Dockerfiles. Teams where developer time costs more than cloud compute.

When it's not: Simple applications, infrequent builds, or if your build server is already fast enough.

The Real Costs of Docker

Docker's pricing model changed everything. Here's what teams actually pay:

Small startups (< 10 developers): Use free Docker Desktop until Docker sends a compliance email. Then either pay $90/month or switch to Rancher Desktop.

Medium companies (10-50 developers): $900-2400/month for Docker Desktop licenses. Plus Docker Hub Pro ($50/month) to avoid rate limits. Plus Docker Scout ($100-500/month) for security scanning.

Enterprise (50+ developers): $10,000-50,000/month for Docker Business. At this scale, most companies also run their own container registries.

Open source alternatives: Podman is free but has rough edges. Rancher Desktop works on Mac/Windows but isn't as polished.

What Actually Matters

For individual developers: Docker Desktop is worth $9/month if you're doing container development regularly. The alternatives are free but frustrating.

For teams: Factor in the total cost - licenses, registry fees, scanning tools. It adds up quickly, but so does debugging container issues.

For enterprises: Docker's enterprise features (SSO, image signing, policy management) are genuinely useful if you have compliance requirements. Otherwise, you're paying for support.

The ecosystem works, but Docker's transformation from free open-source tool to paid platform caught everyone off guard. Budget accordingly.

For teams just getting started, focus on the core Docker engine and Docker Compose - they're still free and cover 90% of container use cases. As you scale, the paid tools become worth considering, but you'll know when you need them because the free alternatives will start causing more problems than they solve.