The `docker inspect` command with a Go template format is the most direct and reliable method to query the specific state information of a container, including its exit code. While `docker ps -a` shows status, it doesn’t explicitly show the numeric exit code, and the other commands are for viewing logs or runtime stats.

The `-d` or `–detach` flag runs the container in the background and returns control to the terminal. This is perfect for running a script to completion. `-it` is for interactive sessions, `–rm` cleans up the container afterward but doesn’t control execution mode, and `-v` is for mounting volumes.

A `.dockerignore` file prevents unnecessary files (like local dependencies, logs, git history) from being sent to the Docker daemon as part of the build context. This dramatically reduces the time spent on the `SENDING BUILD CONTEXT` step, especially when only a few relevant files have changed. Multi-stage builds optimize the final image size, not the context transfer.

The `depends_on` directive only controls the startup *order*. It does not wait for the service’s application to be ready (for that, you need healthchecks). It also does not create the network link—Docker Compose networks do that automatically. Its sole function in this context is to ensure `db` is started before `web`.

Environment variables are part of a container’s configuration, which is immutable at runtime. The correct, Docker-native pattern is to treat containers as immutable. To change the configuration, you must stop the container, remove it, and run a new one with the updated environment variables, typically orchestrated by a system like Docker Compose or a Swarm/Kubernetes service update.

`docker system prune` is the correct command. It removes all stopped containers, unused networks, dangling images (images not referenced by any container), and the build cache. The `-a` flag would also remove all images not referenced by *any* container (even running ones), which is too aggressive. The other commands only target specific resource types.

In Swarm, the `–mode replicated` (which is the default) along with `–replicas 3` instructs the swarm manager to maintain three identical tasks (containers) for the service, distributing them across nodes. This provides high availability. `–mode global` runs one task per node and ignores the replicas flag. Restart policies are for container-level failures, not for defining the service’s scale.

The `docker logs -f` (or `–follow`) command streams the container’s stdout/stderr logs to your terminal in real-time. This is the standard Docker-native way to follow logs. `docker attach` attaches your terminal to the container’s main process, which can be intrusive. Using `docker exec` to tail a file assumes logs are written to a file, not stdout, which contradicts the scenario.

The security best practice is to explicitly create a non-root user (with a known UID/GID), set file permissions for that user on necessary directories like `/app`, and then use the `USER` instruction to switch to that user for the remainder of the build and the container’s runtime. Simply using `USER 1000` assumes a user with that UID exists, which may not be true. While `–user` works, baking it into the image is more secure and declarative.

The `docker inspect` command with a Go template format is the most direct and reliable method to query the specific state information of a container, including its exit code. While `docker ps -a` shows status, it doesn’t explicitly show the numeric exit code, and the other commands are for viewing logs or runtime stats.0