Glossary

A YAML manifest describing one or more services, their images, volumes, networks, and dependencies. "docker compose up" reads it and creates everything.

A running instance of an image. Has its own filesystem layer on top of the image, its own process tree, and its own network namespace, but shares the host kernel.

An isolated L2 segment Docker creates for containers. Containers on the same network reach each other by service name. Default "bridge" allows DNS resolution; the legacy "host" mode shares the host network stack.

A command Docker runs periodically inside a container to determine if it's healthy. Composes can wait on dependencies to be healthy before starting downstream services.

An immutable filesystem snapshot that containers are instantiated from. Pulled from a registry (Docker Hub, GHCR, lscr.io). Each image has one or more tags pointing at versions.

The immutable SHA-256 identifier for an image. "image: app:latest@sha256:abc..." pins to an exact build even if "latest" moves. The right way to lock dependencies for stateful services.

A Docker network driver that gives a container its own MAC address on the host LAN. Useful when an app needs to broadcast/discover on the same L2 (Home Assistant SSDP, AirPlay receivers).

Per-container setting that controls what happens on crash or host reboot. "unless-stopped" is the right default for services; "on-failure" for batch jobs.

A server that fronts your containers, terminating HTTPS and routing by hostname. Traefik, Caddy, and nginx-proxy-manager are the popular options in homelabs.

Persistent storage that survives container restarts. Docker-managed named volumes live under /var/lib/docker/volumes; bind mounts point to a host path you choose. Use bind mounts for things you back up.