A container runs a process in an isolated environment based on an image. An image packages the application and its runtime dependencies. Building an image and running a container are separate operations. A container’s writable layer should not be the only copy of important application data.
Expose only necessary ports and keep runtime secrets out of the image. A service listening inside a container is not automatically reachable from the host. Understand the mapping between internal and external ports and the network names used between services.
Use a persistent volume or external store for data that must survive replacement. A reproducible container still needs configuration checks, health behavior, and a rollback plan.
Exercise: write a container design for your Python API, identifying source files, dependency installation, startup command, port, and persistent data. If a container runtime is available, build and run it locally.
Check: replacing the application container does not silently erase the intended durable data, and no credential is baked into the image.