Docker Containers and AWS Cloud Fundamentals: Commands, EC2, IAM, and Networking

What is containerization, and how does it differ from a virtual machine?

Containers package applications with dependencies while sharing the host operating-system kernel. Virtual machines run separate guest operating systems on virtualized hardware, so containers are typically lighter and start faster.

What is Docker, and what are its main components?

Docker is a platform for building, distributing, and running containers. Its key concepts include Dockerfiles, images, containers, the Docker Engine, and image registries.

What is the difference between a Docker image and a Docker container?

An image is an immutable packaged template containing an application and dependencies. A container is an instance of that image running as an isolated process.

What is a Dockerfile, and what do FROM, WORKDIR, COPY, RUN, and CMD do?

A Dockerfile is a recipe for building an image. FROM chooses a base image; WORKDIR sets the working directory; COPY adds files; RUN executes build-time commands; CMD specifies the default container command.

What is a multi-stage Docker build, and why use it for Spring Boot?

A multi-stage build compiles the application in a builder stage and copies the resulting JAR into a smaller runtime stage. It keeps build tools out of the final image and reduces image size.

How do docker build, docker run, and docker ps differ?

docker build creates an image from a Dockerfile; docker run creates and starts a container from an image; docker ps lists running containers (use -a to include stopped containers).

What do docker pull, docker tag, and docker push do?

docker pull downloads an image from a registry; docker tag adds or changes a registry/repository tag for an existing image; docker push uploads the tagged image to a registry.

What is the difference between a Docker volume and a container filesystem?

A container writable layer is generally discarded when that container is removed. A volume persists data independently of the container and can be reused.

What is the difference between Docker Hub and Amazon ECR?

Docker Hub is a general-purpose public/private container image registry. Amazon ECR is AWS-managed container image storage integrated with AWS IAM and deployment services such as ECS.

What is the purpose of a .dockerignore file?

It excludes unnecessary files from the Docker build context, such as local build outputs, logs, and secrets. This can speed up builds and reduce unintended file inclusion.

What do EXPOSE, ENV, and ENTRYPOINT mean in a Dockerfile?

EXPOSE documents the port an image expects to use, ENV sets environment variables, and ENTRYPOINT defines the main executable to run when a container starts. EXPOSE alone does not publish a host port.

What does docker run -p 8080:8080 accomplish?

It maps port 8080 on the host to port 8080 inside the container, allowing traffic to reach a service listening on that container port, subject to network and application settings.

Why are Docker image layers and build caching useful?

Docker builds images in reusable layers. If earlier steps have not changed, cached layers can reduce rebuild time; structuring a Dockerfile to copy dependency files before frequently changing source often improves caching.

What is the difference between a container registry and container orchestration?

A registry such as Docker Hub or Amazon ECR stores and distributes container images. An orchestrator such as ECS or Kubernetes deploys, schedules, scales, and monitors running containers.

How can you inspect a container that fails to start?

Use docker ps -a to check container status and docker logs for application output. Also inspect the configured command, environment variables, ports, and required dependencies.

What does `docker ps -a` show compared with `docker ps`?

`docker ps` lists running containers. `docker ps -a` lists all containers, including stopped and exited ones; use it to identify containers that failed or terminated.

What is the difference between `docker run` and `docker start`?

`docker run IMAGE` creates a new container from an image and starts it. `docker start CONTAINER` starts an existing stopped container without creating a new one.

What do `docker stop` and `docker kill` do differently?

`docker stop` requests graceful shutdown, allowing the main process time to exit before forcing termination. `docker kill` sends a termination signal immediately (SIGKILL by default), so it is more abrupt.

How do you view logs from a running or stopped Docker container?

Use `docker logs CONTAINER`, or `docker logs -f CONTAINER` to stream new log output. This is a first step for diagnosing startup failures and application exceptions.

How do you open an interactive shell in a running container?

Use `docker exec -it CONTAINER sh` (or `bash` if installed). `-i` keeps standard input open and `-t` allocates a terminal; the container must already be running.

What is the difference between `docker rm` and `docker rmi`?

`docker rm CONTAINER` removes a container. `docker rmi IMAGE` removes a local image, provided it is not required by existing containers or removal is otherwise allowed.

What does the command `docker run -d -p 8080:80 nginx` mean?

It creates and runs an Nginx container in detached mode (`-d`) and maps host port 8080 to container port 80. Browsers reach the service through the host on port 8080.

What does `docker inspect CONTAINER` help you find?

`docker inspect` prints detailed JSON metadata such as container configuration, environment variables, networking, mounts, and state. Use it when `docker ps` or logs do not explain a problem.

How do you find the installed Docker version and verify Docker can run containers?

Use `docker --version` for the CLI version and `docker run hello-world` for a basic engine test. `docker info` provides information about the daemon and its environment.

What is the practical difference between `COPY` and `RUN` in a Dockerfile?

`COPY` places files from the build context into an image. `RUN` executes commands during image build, such as installing packages or compiling code; neither is the container startup command.

What is the difference between `ENV` and `ARG` in a Dockerfile?

`ARG` supplies build-time values and is not automatically available when a container runs. `ENV` sets environment variables that persist in the image and are normally available at runtime. Neither is a safe place to bake sensitive secrets into an image.

What is a Docker image tag, and why avoid relying only on `latest`?

A tag is a human-readable image reference such as `myapp:1.2.0`. Specific version or commit tags make deployments reproducible and traceable, whereas `latest` is mutable and does not guarantee the newest build.

What is Docker Compose used for, and which command starts a Compose application?

Docker Compose defines multi-container applications, networks, and volumes in a YAML file. Run `docker compose up -d` to create and start the defined services in the background.

What is a bind mount compared with a Docker volume?

A bind mount maps a specific host file or folder into a container; a Docker volume is managed by Docker. Both can persist data, but volumes usually simplify containerized data management.

Why should containers generally run as non-root users?

Running a process without root privileges reduces potential damage if the process is compromised. It is one layer of defense alongside minimal images, patched dependencies, and limited permissions.

What does docker network ls show?

Lists Docker networks that exist on the Docker host.

What does docker container prune do?

Removes all stopped containers; use with care because removed containers cannot be restarted.

What does the Docker build context contain?

The files available to the builder for a build, typically selected by the path passed to docker build.

What is the purpose of a container health check?

Checks whether the application inside a container is functioning rather than merely whether its process exists.

What is the difference between an AWS Region and an Availability Zone?

A Region is a separate geographic AWS area. An Availability Zone is an isolated data-center location within a Region. Deploying across AZs improves availability if one AZ fails.

What is IAM, and what is the principle of least privilege?

AWS Identity and Access Management controls which identities can access resources and what actions they can perform. Least privilege means granting only the permissions necessary for the task.

What is EC2, and when would you use it?

Amazon Elastic Compute Cloud provides virtual server instances. Use EC2 when you need control over the operating system, runtime, and installed software.

What are an AMI and EBS in EC2?

An Amazon Machine Image (AMI) is a template used to launch an EC2 instance. Elastic Block Store (EBS) provides persistent block storage volumes that can be attached to EC2 instances.

What is an EC2 security group?

A security group is a stateful virtual firewall for EC2 resources. Its inbound and outbound rules control allowed network traffic by port, protocol, and source or destination.

What are EC2 Auto Scaling and a load balancer?

Auto Scaling adjusts the number of EC2 instances based on demand or health. A load balancer distributes incoming traffic across healthy targets, improving responsiveness and availability.

What is the AWS shared responsibility model?

AWS secures the underlying cloud infrastructure, while customers are responsible for security in the cloud, including their data, identities, access settings, and configurations. The exact division varies by service.

What is a VPC, and why do subnets matter?

A Virtual Private Cloud is a logically isolated AWS network. Subnets divide its IP address space into network segments, allowing different routing and access for resources such as a public load balancer and private database.

What is an IAM role, and how does it differ from an IAM user?

An IAM user is an identity with long-term credentials if configured. An IAM role is assumed temporarily by users or services, supplying permissions through temporary credentials; ECS tasks commonly use roles.

How do you connect securely to a Linux EC2 instance using SSH?

Typically use `ssh -i key.pem ec2-user@PUBLIC_IP` (the username depends on the AMI), with the private key protected and security group rules allowing SSH from an appropriate source IP.

What is an EC2 key pair used for?

An EC2 key pair supplies public-key cryptography for supported instance login methods, especially SSH to Linux. The public key is configured for the instance and the user protects the private key.

What is an EC2 instance type, and what affects the choice?

An instance type specifies a hardware resource profile such as vCPUs, memory, storage, and networking. Choose based on workload needs, performance requirements, architecture, and cost.

What is the difference between stopping and terminating an EC2 instance?

Stopping an EBS-backed instance shuts it down while usually preserving attached EBS volumes, so it can be started again. Terminating permanently removes the instance and may delete EBS volumes according to their delete-on-termination setting.

What is Amazon EBS, and why is it called persistent storage?

EBS provides block-storage volumes for EC2 and related uses. Data on an EBS volume can persist beyond an instance stop, unlike temporary in-memory data; persistence after termination depends on volume settings.

What is a security group inbound rule versus an outbound rule?

Inbound rules define which new connections may reach the resource. Outbound rules define which connections the resource may initiate. Security groups are stateful, so response traffic for allowed connections is automatically permitted.

What is an Elastic IP address?

An Elastic IP is a static public IPv4 address allocated to an AWS account for use with supported resources. It can be reassociated, but AWS may charge for public IPv4 address usage.

What happens when EC2 Auto Scaling replaces an unhealthy instance?

An Auto Scaling group compares actual capacity with its desired capacity and health status. If an instance becomes unhealthy, it can terminate or replace it to restore the desired number of instances.

What is the difference between a public subnet and a private subnet in a VPC?

A public subnet has a route to an internet gateway; a private subnet does not have a direct route to the internet gateway. A private subnet can still obtain outbound access through configured mechanisms such as a NAT gateway.

How does an Application Load Balancer use target groups and health checks?

An ALB listener uses rules to forward requests to a target group. Health checks help determine which registered targets are healthy enough to receive traffic.

What is the difference between Route 53 and CloudFront?

Route 53 is primarily DNS and domain routing; CloudFront is a CDN for delivering cached content and forwarding requests to configured origins. A domain can use Route 53 DNS to reach a CloudFront distribution.

What does the AWS CLI command `aws sts get-caller-identity` tell you?

It returns the AWS account and principal identity associated with the current credentials. It is useful for confirming which IAM user or assumed role is active before deployment.

What is the difference between a security group and a network ACL?

Security groups are stateful and attached to resources; network ACLs are stateless subnet-level traffic filters.

Why would you deploy application instances across multiple Availability Zones?

To improve availability and reduce the impact of an Availability Zone failure.

What does the EC2 user data feature do?

Runs configured initialization scripts during instance launch, often to install packages or start services.

What is the difference between horizontal and vertical scaling on EC2?

Horizontal scaling adds more instances; vertical scaling increases resources on an existing instance.

What is the role of an internet gateway in a VPC?

It provides a routing target for communication between VPC resources with suitable routes and the internet.

What is a NAT gateway typically used for?

It lets resources in private subnets initiate outbound internet connections without accepting unsolicited inbound connections.

What is the difference between a monolith and microservices?

A monolith packages application functions into one deployable application. Microservices split functions into independently deployable services communicating over APIs or messaging, trading isolation and scaling flexibility for distributed-system complexity.

What is service discovery, and what does Netflix Eureka do?

Service discovery helps services locate available instances of other services without hardcoded addresses. Eureka provides a registry where services can register and look each other up.

What does an API Gateway do in a microservices architecture?

An API Gateway provides an entry point for client requests and routes them to backend services. It may also provide cross-cutting features such as authentication, rate limiting, or request filtering.

What is OpenFeign (Feign Client) in Spring Cloud?

OpenFeign is a declarative HTTP client. Developers define an interface describing remote API calls, and the framework provides the HTTP client implementation.

What is the circuit breaker pattern?

A circuit breaker stops repeatedly calling a failing remote dependency after failures exceed a threshold. It can fail fast or use a fallback, then probe later to determine whether the dependency has recovered.

What are Spring Cloud Config Server and distributed tracing?

Config Server centralizes application configuration for multiple services. Distributed tracing follows a request across service boundaries to help diagnose latency and failures.

What is CQRS?

Command Query Responsibility Segregation separates operations that change state (commands) from those that read state (queries). It may use different models for writes and reads when that complexity is justified.

Why can microservices be harder to operate than a monolith?

Independent services add network calls, deployment coordination, distributed logs, and possible partial failures. Teams must handle service discovery, observability, retries, and data consistency across boundaries.

What is the database-per-service pattern?

Each microservice owns its data store or data schema rather than directly sharing database tables. This reduces coupling but requires API calls, messaging, or other coordination for cross-service data.

What is the difference between synchronous and asynchronous microservice communication?

Synchronous calls, such as HTTP requests, usually wait for a response and can propagate latency or outages. Asynchronous messaging allows services to process events independently but introduces eventual consistency and message-handling concerns.

What is a fallback in the circuit breaker pattern?

A fallback is an alternative response or behavior when a remote dependency cannot be used, such as returning cached data or a controlled error. It should not conceal unsafe or incorrect application results.

What is client-side load balancing in Spring Cloud?

Client-side load balancing selects a service instance from discovered available instances before making a request. Spring Cloud LoadBalancer can integrate with service discovery to distribute requests.

Why is CQRS useful when read traffic is much higher than write traffic?

CQRS separates read and write models so the read side can be optimized or scaled for frequent queries without forcing the write side to use the same data representation or scaling strategy.

Does CQRS require two databases or a microservices architecture?

No. CQRS only requires separating command and query responsibilities. A monolith can implement CQRS using one database; separate databases and services are optional design choices.

What is eventual consistency in a CQRS read model?

When the write model updates first and the read model is refreshed asynchronously, a query may briefly return older data. After updates propagate successfully, the read representation converges with the write state.

What is a command handler compared with a query handler in CQRS?

A command handler processes an instruction to change state and applies relevant business rules. A query handler retrieves and returns data without intentionally changing the application state.

What is Quality of Service (QoS), and how might it be measured?

QoS broadly describes measurable service performance and dependability, such as latency, throughput, availability, and error rate. The exact meaning depends on context; the phrase was not a named standalone heading in the Week 9 lessons.

What is the difference between latency and throughput?

Latency is the time it takes to complete an operation or respond to a request. Throughput is the number of operations or amount of data processed per unit of time; a system can have high throughput but poor latency.

What is the difference between an SLI, SLO, and SLA?

An SLI is a measured reliability indicator, such as successful-request rate. An SLO is the target for that indicator, such as 99.9% availability. An SLA is a formal service commitment that may specify consequences for missing targets.

What is the difference between reliability, availability, and fault tolerance?

Availability describes whether a system is usable at a given time or over a period. Reliability concerns correct operation over time. Fault tolerance is the ability to keep functioning despite certain component failures.

What is the difference between Eureka service discovery and an API Gateway?

Eureka registers and discovers service instances so clients can find them. An API Gateway is an entry point that routes incoming requests to backend services and can apply shared policies.

What are the three usual circuit breaker states?

Closed allows calls while monitoring failures; open rejects or fails fast without calling the dependency; half-open allows a limited number of test calls to evaluate recovery.

What is distributed tracing, and why is it useful for microservices?

Distributed tracing links related operations across services into a trace. It helps identify slow or failing parts of a request path that crosses multiple APIs and services.

How does Eureka use service heartbeats?

Registered service instances periodically renew their leases so the registry can track available instances.

What is Eureka self-preservation mode?

A safeguard that can suspend mass eviction when many expected heartbeats are missing.

What is the difference between Eureka and Consul?

Both support service discovery; Consul also offers broad health-checking and key-value/service-networking features.

What is Spring Boot Actuator used for?

Exposes application operational endpoints such as health information and metrics.

What do Prometheus and Grafana do?

Prometheus collects and stores time-series metrics; Grafana visualizes metrics in dashboards.

What is the difference between a retry and a circuit breaker?

A retry repeats a failed attempt; a circuit breaker temporarily blocks calls to an unhealthy dependency.

What is service availability?

The proportion of time or requests for which a service is accessible and usable under the chosen definition.

What is a service health check?

A test that indicates whether a service is running or ready to serve requests.

What is DevOps, and what problem does it address?

DevOps is a culture and set of practices that brings development and operations together to deliver software reliably and quickly through collaboration, automation, monitoring, and feedback.

What is continuous integration (CI)?

CI means frequently merging code changes into a shared repository and automatically building and testing them to catch integration problems early.

How do continuous delivery and continuous deployment differ?

Continuous delivery automatically prepares validated changes for release but can require manual production approval. Continuous deployment automatically releases every change that passes the pipeline.

What is GitHub Actions, and what starts a workflow?

GitHub Actions is GitHub's workflow automation platform. Workflows are YAML files triggered by events such as push, pull_request, a schedule, or manual dispatch.

What is the difference between a workflow, job, step, action, and runner?

A workflow is the full automation definition; jobs are groups of steps; steps run commands or reusable actions; an action packages reusable functionality; a runner is the machine executing a job.

What is YAML used for in GitHub Actions?

YAML expresses workflow configuration, including triggers, jobs, runners, and steps. A workflow file is generally stored under .github/workflows/ in the repository.

What is a GitHub Actions secret, and why should credentials not be committed to code?

A GitHub Actions secret stores a sensitive value for controlled use by workflows. Keeping credentials out of source code reduces accidental exposure, though access permissions and logs still require care.

What is Infrastructure as Code (IaC), and what is Terraform?

IaC defines infrastructure through version-controlled configuration instead of manual clicks. Terraform is an IaC tool that plans and applies changes to provision infrastructure from declarative configuration.