Docker review for testing: pricing, alternatives and setup

An image is a stack of read-only filesystem layers built from a Dockerfile, one layer per instruction. A container is an ordinary process on the host, given its own view of the filesystem, network and process tree through Linux namespaces, and limited by cgroups. Nothing is emulated, which is why a container starts as fast as the process inside it. Layers are cached and shared: when you rebuild, Docker reuses every layer up to the first instruction whose inputs changed and rebuilds from there. That single rule explains most slow test-image builds, where copying the whole repository before installing dependencies forces a full dependency install on every code change.

The docker command is only a client. It sends API calls to the Docker daemon, dockerd, which manages images, networks and volumes and hands the running of containers to containerd and runc. Because everything goes through that API, the same CLI can drive a remote engine through DOCKER_HOST, and libraries such as Testcontainers can start containers from inside a test. It is also why access to the daemon socket, or membership of the docker group, gives root-level control of the host. Since Engine 29.0, released on 10 November 2025, fresh installs use the containerd image store by default instead of the classic image store.

Linux containers need a Linux kernel. Docker Desktop on macOS and Windows runs a Linux virtual machine, on Windows through WSL 2 or Hyper-V, and the containers run inside it. Bind mounts cross the VM boundary through a file-sharing layer, which is why a suite mounted from the host runs slower than on Linux, and why Docker sells Synchronized File Shares on its paid plans. CPU and memory are what the VM was allocated, not the whole machine, so a Grid with several Chrome nodes can starve on a laptop with plenty of RAM. Linux CI runners have no VM in the way, which is one reason CI can outrun a developer’s Mac.

Compose reads a YAML file of services, networks and volumes and creates them as one project, with a private network on which services reach each other by name. depends_on with condition: service_healthy makes a service wait for another’s health check to pass, and docker compose up --wait returns only when services are running and healthy. Those two features are what turn a pile of containers into a test fixture you can depend on. Compose is now a CLI plugin invoked as docker compose, at version 5.6 on 13 October 2026; the old Python docker-compose stopped receiving updates in July 2023, and the top-level version key is informative only.

Keep test infrastructure next to the code it tests: compose.yaml at the repository root, a Dockerfile.e2e for the suite and a .dockerignore that keeps node_modules, reports and .git out of the build context. Order the Dockerfile from least to most frequently changed, so the dependency layer is reused until the lockfile changes and only the final copy of test code reruns. For Playwright, start from Microsoft’s image, which already contains the browsers and their system libraries, and keep its tag equal to the @playwright/test version in your lockfile: the Playwright docs warn that a mismatch leaves it unable to find the browser executables. Pin every tag in full, and treat the bump as a pull request with its own test run.

Putting the test runner on the same Compose network as the application removes the localhost problem and makes the run identical on every machine. A profile keeps the suite out of a plain docker compose up, so developers can start the environment alone, and docker compose run starts the services the runner depends on and returns the runner’s exit code, which is what CI needs to pass or fail the job. The Playwright documentation recommends --ipc=host for Chromium and --init to avoid zombie processes, and Compose exposes both as service keys. Mount the report folder back to the host so evidence survives the container.

GitHub-hosted Ubuntu runners come with Docker and the Compose plugin, so the pipeline is the same commands you run locally. Sign in to Docker Hub first: hosted runners share IP addresses, and the anonymous limit of 100 pulls per six hours is reached sooner than you would expect. Start the environment with --wait and a timeout, so a dependency that never becomes healthy fails the job quickly with a clear message instead of a cascade of test failures. On failure, save the service logs alongside the test report, because the cause is often in the application container rather than in the test output. Always tear down, so a self-hosted runner does not accumulate stale volumes.

Start with state, then logs, then the inside of the container. docker compose ps shows which services are running and whether each one is healthy; a service stuck in starting usually means its health check command is wrong rather than the service being broken. docker inspect shows the last few health check results with their output. docker compose logs with a service name and --since narrows the noise to the failure window. docker compose exec opens a shell inside a running service, which is the quickest way to check DNS, environment variables and whether a port is really listening. For browser tests on the Selenium images, port 7900 serves a noVNC view of the live browser, which shows what the test saw without adding a single screenshot call.

Images age even when nobody touches them, because their base layers accumulate security fixes upstream. Rebuild test images on a schedule as well as on change, and let Dependabot or a similar bot propose base image updates as pull requests, which keeps the pinning discipline without the manual chore. Run tests as a non-root user where the image supports it, and never mount the Docker socket into a test container unless the tool genuinely needs it, as Testcontainers does when run inside a container. On self-hosted runners and developer machines, dangling images and build cache grow until a disk fills mid-pipeline: docker system df shows where the space has gone, and a scheduled docker system prune with a filter on age keeps it under control.