Statically linking the application during the build stage is the most robust and secure solution. It eliminates runtime dependencies on specific system libraries, making the container more portable and secure (no need for package managers or extra packages in the final image). It also keeps the image size smaller than switching to a full distro base image.

By default, Docker containers on the default bridge network inherit the host’s `/etc/resolv.conf`. If internal DNS is configured elsewhere, this breaks. Creating a custom network (or using the host network mode for specific cases) and specifying the `–dns` option for the Docker daemon or per-container gives you explicit control over the DNS configuration inside the container, which is the standard solution for this common enterprise scenario.

The core security best practice is to run containers as a non-root user whenever possible. The `USER` directive in the Dockerfile is the declarative, built-in method to achieve this. It ensures the principle of least privilege is baked into the image itself, making it the default and most effective long-term mitigation. The other options are secondary protections that are useful but don’t address the primary issue of running as root.

Docker Volumes are the preferred mechanism for persistent, shared data managed by Docker. They are independent of the container lifecycle, can be efficiently shared among multiple containers, and their drivers facilitate use across a cluster of hosts (e.g., with a volume plugin). Bind mounts are tied to the host filesystem, which reduces portability, while tmpfs and the container layer are not persistent.

Docker caches layers. If an instruction changes, all subsequent layers have their cache invalidated. Placing `COPY . /app` early in the Dockerfile means any change to any file in the build context (including source code) invalidates that layer and every layer after it (like `RUN npm install`). The best practice is to copy dependency files (`package.json`, `package-lock.json`) first, run the dependency installation, and then copy the rest of the application code. This leverages the cache for the expensive `npm install` step.

The choice of base image has the most significant impact on final image size. Full-tag images (like `python:3.9`) contain a complete OS with many packages. Slim variants (`python:3.9-slim`) are stripped-down, containing only the minimal essentials to run the language. This can reduce image size by hundreds of megabytes. While a `.dockerignore` is important, it prevents files from being copied in, but doesn’t reduce the size of the underlying OS layer. Combining instructions saves layers but not necessarily significant space.

The `docker kill` command is specifically designed to send a signal to the main process inside a running container. The `–signal` flag allows you to specify which signal to send (default is SIGKILL). `docker stop` also sends a SIGTERM (then SIGKILL), but you cannot directly control the signal with it. `docker exec` could work but requires knowing the PID and is less direct. `docker pause` uses cgroups freezer, not signals.

For development on a Linux host, bind mounts provide a direct mapping between a host directory and a container directory. Changes made on the host are immediately visible inside the container with native filesystem performance, which is ideal for development workflows with live reload. Volumes are better for production and shared data but can be slightly more abstract. `docker cp` and rebuilding are inefficient and manual.

`docker exec top` (or `htop` if installed) gives you a real-time, interactive view of processes *inside* the container’s PID namespace, which is the correct context. Pressing ‘H’ toggles the display to show threads, which is crucial for identifying if a single-threaded application is maxing out a core or if a specific thread is busy. `docker top` shows processes from the host’s perspective, which can be confusing with PIDs. Logs and inspect don’t provide real-time CPU diagnostics.

Statically linking the application during the build stage is the most robust and secure solution. It eliminates runtime dependencies on specific system libraries, making the container more portable and secure (no need for package managers or extra packages in the final image). It also keeps the image size smaller than switching to a full distro base image.0