Builders who are new to all this.

• You've maybe vibe-coded a small app or script.
• You've heard “Docker” a hundred times. Still unsure what it is.
• You want to run your own thing, safely, without hand-waving.

By the end: you'll have built, run, and curl-tested a real containerized API, and you'll know why Podman is the safer sibling worth meeting next.

“It works on my laptop.”

Different OS. Different Python version. A dependency installed years ago that nobody wrote down. A missing env var. A port already in use.

Containers end that conversation. Your app ships with its whole little world around it.

What's an operating system?

• The kernel. The small core program that talks to the hardware (CPU, disk, network).
• Userland. Everything else: your shell, your tools, your apps.
• On Linux, the same kernel runs on your laptop, in a VM, in the cloud. That sameness is why containers can share it.

Linux is the gateway.

• Most cloud servers you'll ever touch run Linux.
• Comfort on a Linux shell ⇒ you can also run your own nginx (reverse proxy, load balancing), harden a box with fail2ban, manage firewalls.
• Windows and Mac can't give you that locally.

Teasers for all of these at the end. Worth the self-study after this workshop.

Get Ubuntu running inside Windows.

• Open Microsoft Store, search Ubuntu 24.04, click Get.
• Launch Ubuntu, set a username + password (the password cursor is invisible; that's normal).
• Confirm you're in Linux: uname -a

If the Store fails: open PowerShell as Admin → wsl --install -d Ubuntu-24.04 → reboot if asked.

The commands you'll use every minute.

pwd              # where am I?
ls -la           # list files (long, show hidden)
cd ~/projects    # change directory
whoami           # which user am I?
cat file.txt     # print a file to the screen
mkdir myapp      # make a new folder
nano notes.md    # simple text editor (Ctrl-O save, Ctrl-X exit)

Not Docker Desktop. Just the engine.

Docker Desktop needs a paid license for larger companies. Engine-only is free, same CLI.

# 1. Add Docker's official apt repo
curl -fsSL https://get.docker.com | sudo sh

# 2. Let your user run docker without sudo
sudo usermod -aG docker $USER
newgrp docker

# 3. Verify
docker --version
docker run hello-world

nginx in a container.

docker run -d -p 8080:80 --name web nginx

• -d: run detached (in the background)
• -p 8080:80: publish host port 8080 to container port 80
• --name web: a friendly name you can reference later

Now open http://localhost:8080 in your browser. You're running nginx, in Linux, in a container, and never typed apt install nginx.

Living with your containers.

docker ps                 # running containers
docker ps -a              # including stopped
docker logs web           # what's it saying?
docker logs -f web        # follow logs (Ctrl-C to stop)
docker exec -it web bash  # a shell INSIDE the container
docker stop web           # graceful stop
docker rm web             # remove it
docker images             # local images you've pulled/built
docker pull python:3.12-slim
docker rmi hello-world    # remove an image
docker system prune       # clean up unused stuff

One file. Plain HTML. No JS, no CSS.

Eight dishes, six spots. Tags mean what they say, so the browser renders it readable even with zero styling.

<!-- cebu-eats/site/index.html -->
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Cebu Eats &amp; Spots</title>
</head>
<body>

<h1>Cebu Eats & Spots</h1>
<p>Eight dishes you must try. Six places you must see.</p>

<h2>Eats</h2>
<dl>
  <dt><b>Lechon</b> <i>(Carcar / Talisay)</i></dt>
  <dd>Spit-roasted suckling pig. Crackling skin, lemongrass-stuffed belly, no sauce needed.</dd>

  <dt><b>Tuslob Buwa</b> <i>(Pasil, Cebu City)</i></dt>
  <dd>Pig brain and liver simmered into a frothy dip. Eaten by hand with puso, elbow-to-elbow at a street stall.</dd>

  <dt><b>Puso</b> <i>(all over Cebu)</i></dt>
  <dd>Hanging rice woven inside coconut leaves. The default pairing for lechon, bbq, and tuslob buwa.</dd>

  <dt><b>Humba</b> <i>(Cebuano household)</i></dt>
  <dd>Pork belly slow-braised in soy, vinegar, brown sugar, and tausi. Deep, sweet, savory.</dd>

  <dt><b>Ngohiong</b> <i>(Chinese-Cebuano)</i></dt>
  <dd>Five-spice spring roll, deep-fried, served with sweet-and-sour sauce. Street-food royalty.</dd>

  <dt><b>SuTuKil</b> <i>(Mactan seaside)</i></dt>
  <dd>Sugba, Tuwa, Kilaw: grilled, in soup, raw-cured. Pick your fish, pick all three preparations.</dd>

  <dt><b>Sinuglaw</b> <i>(Cebuano fusion)</i></dt>
  <dd>Grilled pork belly meets kinilaw. Smoky sugba on top of vinegar-cured raw fish. Two worlds in one bowl.</dd>

  <dt><b>Siomai sa Tisa</b> <i>(Tisa, Cebu City)</i></dt>
  <dd>Pork-and-shrimp dumplings steamed in bamboo, dunked in chili-vinegar-soy. An entire alley of stalls competes for your pesos.</dd>
</dl>

<h2>Spots</h2>
<dl>
  <dt><b>Magellan's Cross</b> <i>(Cebu City)</i></dt>
  <dd>Planted in 1521 by Magellan's crew. The symbolic start of Christianity in the Philippines.</dd>

  <dt><b>Basilica del Santo Ni&ntilde;o</b> <i>(Cebu City)</i></dt>
  <dd>The country's oldest Roman Catholic church, founded in 1565. Home of the revered Santo Niño image.</dd>

  <dt><b>Kawasan Falls</b> <i>(Badian)</i></dt>
  <dd>Turquoise three-tiered waterfall at the end of a short jungle hike. The headline canyoneering destination.</dd>

  <dt><b>Oslob Whale Sharks</b> <i>(Oslob)</i></dt>
  <dd>Snorkel beside wild butanding at dawn. Go early, go ethical.</dd>

  <dt><b>Moalboal Sardine Run</b> <i>(Moalboal)</i></dt>
  <dd>Millions of sardines moving as one silver cloud, five meters off the shore of Panagsama Beach.</dd>

  <dt><b>Tops Lookout</b> <i>(Busay hills)</i></dt>
  <dd>The city laid out below at sunset. Bring a jacket, the wind is honest.</dd>
</dl>

<hr>
<p><small>Static page, served by nginx in one container. Workshop sample for <b>Containers Crash Course</b>.</small></p>

</body>
</html>

Three lines. A real website in a container.

Base image, copy your files in, declare the port. That's the whole recipe for a static site.

# cebu-eats/Dockerfile
FROM nginx:alpine
COPY site /usr/share/nginx/html
EXPOSE 80

That's it. Three real lines. The whole site lives in cebu-eats/site/ and nginx serves it.

Your city, in a container.

# in cebu-eats/
docker build -t cebu-eats .

docker run -d -p 127.0.0.1:8080:80 \
  --name eats cebu-eats

open http://localhost:8080

Image is small (around 90 MB, almost all nginx). You get one page, two sections: Eats (lechon, tuslob buwa, sinuglaw, siomai sa Tisa, and more) and Spots (Kawasan, Oslob, Tops, and more). No JS, no CSS, pure semantic HTML.

Same recipe, bigger payload.

A FastAPI CRUD service with a plain-JS frontend. Post a pickleball game, list open games, delete yours. One container, but now there's a backend talking.

Code lives in app/ next to this deck. Clone it and follow along.

Your app's recipe.

FROM python:3.12-slim          # small, pinned base

ENV PYTHONUNBUFFERED=1         # print logs immediately

WORKDIR /app                    # working dir inside the container

COPY requirements.txt ./        # deps first (cache-friendly)
RUN pip install -r requirements.txt

COPY main.py ./                 # then the app
COPY static ./static

RUN useradd app && chown -R app /app
USER app                        # NOT root. critical.

EXPOSE 8000
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

From Dockerfile to running container.

# inside the app/ folder
docker build -t pickle-api .

# run it, publish to localhost only (safer than 0.0.0.0!)
docker run -d \
  -p 127.0.0.1:8000:8000 \
  -v $(pwd)/data:/app/data \
  --name pickle pickle-api

# visit it
open http://localhost:8000

-v $(pwd)/data:/app/data is a volume. Data survives container restart because it lives on your laptop's disk.

No Postman needed.

# CREATE
curl -X POST http://localhost:8000/matches \
  -H "Content-Type: application/json" \
  -d '{"venue":"Ayala Terraces Court 2","date":"2026-10-20 19:00",
       "skill_level":"beginner","players_needed":2,"organizer_name":"Ron"}'

# LIST
curl http://localhost:8000/matches

# GET ONE / UPDATE / DELETE  (ID from the create response)
curl http://localhost:8000/matches/<id>
curl -X PUT    http://localhost:8000/matches/<id> -H "Content-Type: application/json" -d '{...}'
curl -X DELETE http://localhost:8000/matches/<id>

Full script: curl-tests.sh in the deck repo.

Containers are disposable. Data is not.

• Containers are meant to be killed and recreated. That's a feature.
• Without a volume, anything the app writes dies with the container.
• -v /host/path:/container/path mounts a folder from your laptop inside the container.

docker rm -f pickle
docker run -d -p 127.0.0.1:8000:8000 \
  -v $(pwd)/data:/app/data \
  --name pickle pickle-api
curl http://localhost:8000/matches   # your matches are still there

Habits that scale.

Containers are not magic security.

Badly configured containers leak just like anything else. The big ones:

• -p 8000:8000 binds 0.0.0.0 by default → your whole LAN can reach it. Use -p 127.0.0.1:8000:8000 unless you mean to publish.
• Running as root inside the container → a container escape = root on your host.
• Mounting /var/run/docker.sock → that container can now control Docker on the host. Full escape.
• --privileged or --network host → you threw away the isolation you came here for.
• Secrets baked into the image → anyone who docker pulls it reads them.

Isolation is the whole point. Don't disable it to make a tutorial easier.

Machine. Human. LLM.

In the AI era, your tool stack is read by three audiences. Keep all three happy.

Starter Python/Node is fine. For a leaner next step: Go (tiny binaries, fast startup) and Rust (safer, no runtime). Both drop container image sizes dramatically and give Claude/Cursor less to chew on.

When your app needs more than one container.

One YAML file describes all your services. One command brings the stack up.

# docker-compose.yml
services:
  api:
    build: ./backend
    ports: ["8000:8000"]
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: devpass

docker compose up -d
docker compose logs -f
docker compose down

Rootless. Daemonless. Same CLI.

• Rootless by default. Several pitfalls from the previous slide go away for free.
• No background daemon. Each container is just a child process.
• Drop-in CLI. Most docker ... commands work as podman ....

sudo apt install -y podman
alias docker=podman
podman run -d -p 127.0.0.1:8000:8000 pickle-api

One nginx, many backends.

Lives on the host, not in a container. That's the point, and the reason we taught Linux.

sudo apt install -y nginx

# /etc/nginx/sites-available/pickle
upstream pickle_backend {
  server 127.0.0.1:8001;
  server 127.0.0.1:8002;
  server 127.0.0.1:8003;
}
server {
  listen 80;
  location / { proxy_pass http://pickle_backend; }
}

sudo nginx -t && sudo systemctl reload nginx

Jail attackers automatically.

sudo apt install -y fail2ban

# /etc/fail2ban/jail.local
[sshd]
enabled  = true
maxretry = 5

[nginx-botsearch]
enabled  = true
logpath  = /var/log/nginx/access.log

sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Add nginx rate-limiting with limit_req_zone for the belt-and-suspenders combo.

A one-liner each.

• Container registry (Docker Hub, GHCR). Where images are stored and shared. docker push yourname/pickle-api.
• Kubernetes. A container orchestrator for when you have many containers across many machines. Overkill until you need it.
• CI/CD. Build and push images automatically on every git push (GitHub Actions, GitLab CI).
• Reverse proxy + TLS. Caddy, or nginx + certbot, in front of your containers.