Skip to main content
Mapagam

Understanding Docker Architecture

1. Understanding Containers vs Virtual Machines

Aspect Containers Virtual Machines
Isolation Level Process-level isolation Hardware-level isolation
OS Sharing Share host OS kernel Each VM runs full OS
Size Lightweight, few MBs to GBs Heavier, several GBs
Startup Time Seconds Minutes
Resource Usage Efficient, minimal overhead Higher resource consumption
Portability Highly portable across platforms Less portable due to OS dependencies

Key Differences Summary

  • Containers: Share the host OS kernel, offering faster startup and lower resource usage.
  • Virtual Machines: Each has a full OS, providing stronger isolation but at higher cost.

2. Understanding Images vs Containers

Aspect Image Container
Definition An image is a read-only template with instructions for creating a Docker container. A running instance of an image.
Mutability Read-only Read-write
Storage Stored in layers; each layer is cached and shared. Created from an image and includes a writable layer on top of the image layers.
Lifecycle Created once, can be used to create multiple containers. Born from an image and destroyed when stopped or removed.
Usage Example docker build -t myapp . docker run -d --name mycontainer myapp

Example: Image Creation and Container Launch

docker build -t myapp .
docker run -d --name mycontainer myapp
Note: Images are built from Dockerfiles and can be stored locally or pulled from registries like Docker Hub.

3. Understanding Docker Engine Components

Component Description Role
Docker Daemon (dockerd) Background service that manages Docker objects like images, containers, networks, and volumes Core engine responsible for all Docker operations
Docker Client Command-line interface (CLI) that allows users to interact with the Docker daemon Interface for issuing commands like docker run, docker build
Docker Registry Storage and distribution system for Docker images (e.g., Docker Hub, private registries) Stores and retrieves Docker images
Docker Images Read-only templates used to create containers; built from Dockerfiles Base unit for container creation
Docker Containers Runtime instances of Docker images that execute in isolated environments Actual running processes with their own filesystem and network
Docker Networks Isolated communication channels between containers and host systems Enables container-to-container and host-to-container communication
Docker Volumes Persistent storage areas that exist outside the container's filesystem Allows data persistence beyond container lifecycle

Example: Docker Daemon and Client Interaction

docker ps

When you run docker ps, the Docker CLI (client) sends a request to the Docker daemon, which then retrieves and displays the list of running containers.

Note: The Docker daemon runs as a background process on the host system and is responsible for all container operations.

4. Understanding Docker Daemon vs Docker CLI

Component Description Role Communication Method
Docker Daemon Background service that manages Docker objects (images, containers, networks, volumes) Core engine of Docker Unix socket or TCP connection
Docker CLI Command-line interface that allows users to interact with the Docker daemon User-facing tool for managing Docker resources HTTP API over Unix socket or TCP

Example: CLI command execution flow

docker run -d --name my-app nginx

The CLI sends this command to the Docker daemon via HTTP API, which then creates and starts the container.

Note: The Docker daemon must be running for CLI commands to function properly.

Comparison: Daemon vs CLI

  • Docker Daemon: Runs in the background, manages container lifecycle
  • Docker CLI: Acts as a client that communicates with the daemon

5. Understanding Namespaces and cgroups

Feature Description Usage
Namespaces Isolate process resources (PID, network, mount, etc.) Each container gets its own namespace
cgroups Control and limit resource usage (CPU, memory, I/O) Enforced by the kernel

Example: Resource Limits with cgroups

docker run --memory=512m --cpus=0.5 myapp
Note: Namespaces and cgroups work together to provide container isolation and resource control.

6. Understanding Union File Systems

Layer Type Description Usage Example
Base Layer Read-only layer containing the base OS image Used as foundation for all other layers FROM ubuntu:20.04
Read-Write Layer Topmost layer that allows modifications Used for container-specific changes RUN apt-get update
Overlay Layer Union mount combining base and read-write layers Provides the final filesystem view ADD app.js /app/

Example: Layered File System

FROM alpine:latest
RUN apk add --no-cache nginx
COPY ./nginx.conf /etc/nginx/nginx.conf
EXPOSE 80
CMD ["nginx" -g "daemon off;"]
Note: Union file systems allow Docker to efficiently manage image layers and reduce storage usage by sharing common base layers.

Key Concepts

  • Each Docker image is composed of multiple read-only layers
  • The topmost layer is read-write, allowing container-specific changes
  • Union mount combines all layers into a single filesystem view
  • Changes in containers only affect the topmost layer, not base layers

7. Understanding Docker Registry Architecture

Component Description Role
Registry docker-registry Centralized storage for Docker images
Repository library/ubuntu Collection of images under a namespace
Manifest manifest.json Metadata describing image layers and configuration
Layer sha256:abc123... Read-only filesystem changes
Blob sha256:def456... Content-addressable storage unit

Example: Pushing to a Registry

docker push myapp:latest
Note: Docker Registry supports both public (Docker Hub) and private registries.

Registry Types

  • Public Registry: Docker Hub, GitHub Container Registry
  • Private Registry: Self-hosted or cloud-based (e.g., AWS ECR, Azure ACR)

8. Understanding Container Lifecycle States

State Description Transitions Notes
created Container has been created but not started yet. From stopped or exited when starting. Initial state after docker create.
running Container is actively running. To paused, exited, or dead. Most common runtime state.
paused Container is paused (not receiving I/O). To running with docker unpause. Can be resumed using docker unpause.
exited Container has stopped, but still exists in the system. From running, paused, or dead. Can be restarted with docker start.
dead Container has crashed or exited with an error. Cannot transition further without removal or restart. Useful for debugging or cleanup.

Example: Check container state

docker ps --format "table {{.ID}}\t{{.Names}}\t{{.Status}}"
Note: Use docker inspect <container-id> to get detailed lifecycle information including timestamps and exit codes.

9. Understanding Docker Object Hierarchy

Object Description Relationship Usage
Image A read-only template used to create containers. Contains filesystem layers and metadata. Base object for containers Used to build, run, and distribute applications
Container A runnable instance of an image. Includes a running process and isolated filesystem. Built from images Runs applications in isolation
Registry A storage and distribution system for Docker images (e.g., Docker Hub, AWS ECR). Stores and serves images Used for sharing and deploying images
Repository A collection of related images (e.g., library/nginx). Organizes images in registries Groups related Docker images under a namespace
Layer Each image is composed of multiple read-only layers that are stacked together. Part of image structure Enables efficient storage and sharing of image components
Volume A Docker-managed directory that persists data outside the container’s filesystem. Mounted into containers Used for persistent storage and sharing data between containers

Example: Docker Object Hierarchy in Practice

docker build -t myapp:latest .
docker run -d --name app-container myapp:latest
docker volume create mydata
docker run -d --name app-with-volume -v mydata:/data myapp:latest

Key Concepts Summary

  • Image: Read-only template used to create containers.
  • Container: A running instance of an image with isolated filesystem and process.
  • Registry: Centralized storage for Docker images (e.g., Docker Hub).
  • Repository: Namespace for related images (e.g., library/nginx).
  • Layer: Individual read-only filesystem component in an image.
  • Volume: Persistent storage outside the container’s filesystem.

10. Understanding Docker Desktop Architecture

Component Description Version Notes
Docker Engine Core Docker service that manages containers, images, and networks 27.1.0 Runs as a daemon process on the host machine
Docker CLI Command-line interface for interacting with Docker Engine 27.1.0 Used to build, run, and manage containers
Docker Compose Tool for defining and running multi-container Docker applications v2.27.0 Uses YAML files to define services and dependencies
Docker Desktop UI Graphical interface for managing Docker resources v4.30.0 Available on macOS and Windows only

Example: Docker Desktop UI Components


Docker Desktop provides a dashboard with:
- Container management
- Image registry access
- Network and volume controls
- Settings panel for configuration
Note: Docker Desktop includes a built-in Kubernetes cluster for local development.

Key Features of Docker Desktop Architecture

  • Docker Engine runs as a background service
  • CLI tools interact with the engine via API
  • Desktop UI provides visual management of containers and images
  • Kubernetes integration for orchestration capabilities

11. Understanding OCI Runtime Specification

Component Description Role in Docker
OCI Runtime Defines how to run containers according to the Open Container Initiative (OCI) standard. Used by Docker to execute container processes in a secure and standardized way.
Runtime Specification Standardizes the runtime behavior of containers including process execution, filesystem access, and network configuration. Ensures compatibility between different container runtimes like Docker, Podman, and LXC.
Bundle A directory containing all the necessary files to run a container, including config.json and rootfs. Used by OCI-compliant runtimes to define container state and configuration.

Example: OCI Runtime Configuration

{
  "ociVersion": "1.0.2-dev",
  "process": {
    "terminal": true,
    "user": {
      "uid": 0,
      "gid": 0
    },
    "args": [
      "/bin/sh"
    ],
    "env": [
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
    ],
    "cwd": "/"
  },
  "root": {
    "path": "rootfs"
  },
  "mounts": [
    {
      "destination": "/proc",
      "type": "proc",
      "source": "proc"
    }
  ]
}
Note: Docker uses the runc runtime as its default OCI-compliant container runtime.

Key Points

  • The OCI Runtime Specification ensures portability and interoperability of container runtimes.
  • Docker leverages runc to comply with the OCI standard for container execution.
  • OCI bundles encapsulate all necessary components to run a container in a standardized format.

12. Understanding containerd Integration

Component Description Role in Docker
containerd containerd is a container runtime that manages the complete container lifecycle, including image transfer and storage, container execution, and low-level resource isolation. Core runtime for managing containers in Docker
Docker Engine Docker Engine is the client-server application that includes the Docker daemon, REST API, and CLI. Orchestrates containerd to manage containers
CRI (Container Runtime Interface) Interface that allows Docker to integrate with container runtimes like containerd. Enables pluggability of runtimes in Docker

Example: Docker using containerd as runtime

# Check Docker's container runtime
docker info | grep -i runtime

# Output example:
# Runtimes: io.containerd.runc.v2
Note: Docker uses containerd as its default container runtime since version 20.10, replacing the older runc directly.

Key Concepts

  • containerd is the core container runtime in Docker's architecture.
  • Docker Engine communicates with containerd via the CRI to manage containers.
  • Containerd handles image management, container lifecycle, and low-level isolation.

Was this article helpful?

Related Cheat Sheets