docker run in depth

Detach, names, ports, and tags.

docker run takes more flags than any other command, but a small set covers almost everything you do day to day: -d to run detached (in the background), --name to give it a memorable name instead of a random one, -p to publish ports, -e to set environment variables, and the image:tag to say exactly what to run. Combine them and one line brings up a named, reachable service.

$ docker run -d --name web -p 8080:80 nginx:1.27
#             │        │         │       └ image and tag
#             │        │         └ publish: host 8080 -> container 80
#             │        └ a name you choose
#             └ detached: run in the background, return the prompt

Publishing ports

By default a container’s ports are reachable only from inside Docker’s network, not from your host. The -p host:container flag publishes a port: -p 8080:80 forwards your machine’s port 8080 to the container’s port 80. Forget the -p and the container runs fine but you cannot reach it from a browser — a very common beginner “why is nothing at localhost” moment.

$ docker run -d -p 8080:80 nginx:1.27
$ curl -s -o /dev/null -w "%{http_code}\n" localhost:8080
200                    # reachable, because we published the port

Tags pick the version

An image reference is name:tag, and the tag chooses the version. If you leave it off, Docker assumes latest — which is not “the newest” so much as “whatever the publisher last pushed as latest,” and it can change under you. For anything you care about, name a specific tag like nginx:1.27 so two machines pulling “the same” image actually get the same bytes.