A Linux process is a running program with an argument vector, environment, open files and kernel-managed identity. An image is a packaged filesystem and launch configuration. A container is an instance created from that image, with its own runtime settings and lifecycle. You can have an image without a running process and several instances created from one image. “The image is down” usually hides the more useful question: which instance exited, and what did it report?
This course uses Python dictionaries to make those distinctions inspectable. You need functions, lists, dictionaries and exceptions from the free Python foundations. You do not need C++ or a Docker installation for any graded phase. The models do not run a Docker daemon, establish real namespaces or resource limits, or prove isolation. Optional Docker practice later connects the models to a real tool.
Read an inventory before changing it
Imagine a web instance with PID 42, a one-shot migration that exited successfully, and a third instance that has been created but never started. All three can reference app:v1. Counting three image names would confuse instances with reusable packages. Calling the migration “running” because an instance record still exists would confuse lifecycle state with identity.
records = [
{"name": "web", "image": "app:v1", "pid": 42},
{"name": "migration", "image": "app:v1", "exit_code": 0},
{"name": "next", "image": "app:v1"},
]
for record in records:
pid, code = record.get("pid"), record.get("exit_code")
state = "running" if pid is not None else "exited" if code is not None else "created"
print(record["name"], state)The output records success as an exit, because zero is a value. Python's if code would discard that fact. Absence is represented by None; compare it explicitly. The fixture rejects a positive PID together with an exit code because its snapshot contract assigns each instance exactly one state. A real monitoring system may have stale observations from different times; it would need timestamps and reconciliation rules, which this exercise does not invent.
An instance is not a virtual machine
Linux containers use kernel facilities to give processes selected views of files, process IDs and networks. They share a kernel rather than bundling a separate guest kernel like a typical virtual machine. Docker Desktop may itself run Linux inside a virtual machine on another host operating system. Neither observation makes a Python dictionary a security boundary. Privileges, mounts, capabilities and daemon access materially affect the actual boundary.
Practice the distinction
The build asks for a deterministic inventory, with unique instance names and deduplicated image identifiers. Validate a complete record before placing it in a state collection. Treat malformed data as ValueError, since silently dropping an impossible state would make operational reports misleading. Return fresh sorted collections so input ordering cannot change the report and callers cannot alter the original records through an alias.
Before building, explain why exit code 0 belongs in the exited mapping, why two names may reference one image, and why an exited instance is different from an image that has been deleted. The two bug hunts isolate those identity and absence mistakes. Passing this lab demonstrates state classification from supplied records; later live inspection still requires an engine and real process evidence.