Docker basics: images, containers, and the daemon

Docker helped popularize container image distribution and development workflows, and helped establish the OCI standards. Understanding its client–server architecture is the starting point for understanding every Docker operation.

What is a container? A beginner's introduction#

If you have already read the container introduction in the Podman series The basic concepts are explained in detail in Podman 01. Docker and Podman use the same container standards (OCI), so their fundamental concepts are shared, although the engines differ in specific features.

Images and containers

• Image: a read-only template containing everything needed to run a program: code, libraries, and configuration files. Think of it as the "installation package".
• Container: a running instance of an image. Think of it as the "running program".

docker pull nginx:alpine      # 下载镜像（安装包）
docker run nginx:alpine       # 从镜像启动容器（运行程序）

Client–server architecture: Docker's core model#

graph TD
    subgraph "你的终端"
        CLI["docker CLI / $ docker run ..."]
    end
    subgraph "Docker 守护进程"
        SOCK["/var/run/docker.sock / Unix Socket"]
        DOCKERD["dockerd / 以 root 运行 / 常驻后台"]
        CONTAINERD["containerd / 容器生命周期管理"]
    end
    subgraph "容器运行时"
        RUNC["runc / OCI 标准运行时"]
    end
    subgraph "你的容器"
        C["nginx 容器 / 独立进程"]
    end

    CLI -->|"REST API over Unix Socket"| SOCK
    SOCK --> DOCKERD
    DOCKERD --> CONTAINERD
    CONTAINERD --> RUNC
    RUNC --> C

What happens at each step:

1. You enter docker run nginx:alpine
2. The docker CLI sends a request to /var/run/docker.sock
3. dockerd (the daemon) receives the request and checks whether the nginx:alpine image is available locally; if not, it pulls the image from Docker Hub
4. dockerd calls containerd to create the container
5. containerd calls runc to start the container process
6. Your nginx container starts running. The actual process-parent relationships involve the containerd shim and runtime; the container process cannot simply be described as a direct child of dockerd

Three key components#

dockerd (the daemon)

• Always running in the background: starts automatically at system boot and continues to occupy memory
• rootful or rootless: the traditional system daemon runs as root, but rootless operation can also be configured. Permission to control a rootful socket should be treated as privileged access
• Centralized control: this article describes the traditional daemon-managed path. Builds and different contexts may involve additional tools and services
• Management becomes unavailable; existing container behavior depends on settings such as live-restore: an unavailable daemon affects management operations. live-restore can keep standalone containers running during some daemon shutdowns/upgrades, subject to version and log-buffer limits

docker.sock (the communication bridge)

/var/run/docker.sock is dockerd's Unix socket file:

# docker CLI 通过这个 Socket 和 dockerd 通信
ls -l /var/run/docker.sock
# srw-rw---- 1 root docker ... /var/run/docker.sock
#              └ root       └ 属于 docker 组的用户可读写

# 能读写这个 Socket 的人 = 能操控 Docker
# 操控 Docker = 能以 root 身份做任何事
# 这就是为什么 docker 组 ≈ root 权限

Docker Hub (the image registry)

Docker Hub (docker.io) is Docker's public image registry, similar to GitHub but for images:

• docker pull nginx:alpine pulls from Docker Hub by default
• You can also push your own images: docker push exampleuser/myimage:latest
• In mainland China, you may need a registry mirror for faster access (configure registry-mirrors)

How Docker runs a container#

# 典型的一次操作
docker run -d --name web -p 8080:80 -v /data:/usr/share/nginx/html nginx:alpine

# 命令拆解：
# docker     — 调用 Docker CLI
# run        — 创建并启动一个新容器
# -d         — 在后台运行（不占用当前终端）
# --name web — 给容器起名 web（不指定则随机生成）
# -p 8080:80 — 把宿主机的 8080 端口，转发到容器的 80 端口
# -v /data:/usr/share/nginx/html — 把宿主机的 /data 目录，挂载到容器的指定路径
# nginx:alpine — 用哪个镜像

The container lifecycle

pull（拉取镜像）
  │
  ▼
create（创建容器，分配文件系统和网络）
  │
  ▼
start（启动容器进程）
  │
  ▼
running（运行中）
  │
  ├── stop（发送配置的停止信号，等待超时后强杀；默认通常为 SIGTERM）
  │     │
  │     └── 容器进程退出
  │
  ├── kill（发送 SIGKILL，立即强杀）
  │     │
  │     └── 容器进程立即终止
  │
  ├── pause（冻结容器进程（并非关闭全部外部 I/O），不释放内存）
  │     │
  │     └── unpause（恢复运行）
  │
  └── rm（删除容器及其可写层，不自动删除命名卷或镜像）

Docker's strengths and weaknesses#

Why Docker is the most popular choice

Weaknesses

Docker and the OCI standards#

In 2015, Docker donated the runc container runtime to the OCI (Open Container Initiative). OCI defines specifications for images, runtimes, distribution, and more. Two are relevant here:

1. OCI Image Spec — the image format standard (Docker supports OCI and related image formats; check the specific manifest/media type)
2. OCI Runtime Spec — the container runtime standard (runc is the reference implementation)

What this means: common compatible images can be used by Podman or the container engines used by Kubernetes, but they must still match the platform architecture, runtime requirements, and configuration. containerd itself also needs the appropriate tools and configuration. The image format is not proprietary to Docker.