Docker: how a container actually runs

Docker: how a container actually runs An architecture diagram generated by Archify. Registry · Docker Hub / ECR · Architecture component · docker pull / push Registry Docker Hub / ECR docker pull / push Local image store · read-only layers · One host machine (laptop or EC2 instance) Local image store read-only layers Docker network · bridge + ports · One host machine (laptop or EC2 instance) Docker network bridge + ports Developer · types docker run · Architecture component Developer types docker run docker CLI · a REST client · One host machine (laptop or EC2 instance) · Docker docker CLI a REST client dockerd · Engine API server · One host machine (laptop or EC2 instance) · /var/run/docker.sock dockerd Engine API server /var/run/docker.sock containerd · container lifecycle · One host machine (laptop or EC2 instance) containerd container lifecycle runc · execs PID 1 · One host machine (laptop or EC2 instance) runc execs PID 1 Running container · PID 1 + writable layer · One host machine (laptop or EC2 instance) › Kernel-enforced isolation Running container PID 1 + writable layer Volume / bind mount · outlives the container · One host machine (laptop or EC2 instance) Volume / bind mount outlives the container Host Linux kernel · namespaces, cgroups · One host machine (laptop or EC2 instance) › Kernel-enforced isolation Host Linux kernel namespaces, cgroups docker run -p 8080:80 app:1.0 HTTP over the unix socket dockerd pulls missing layers resolve image layers create task OCI bundle exec PID 1 publish 8080 -> 80 namespaces + cgroups mount One host machine (laptop or EC2 instance) Kernel-enforced isolation Legend Frontend Backend Database Cloud Security External

Image vs container

  • • An image is a stack of read-only layers built from a Dockerfile
  • • A container is those layers plus one thin writable layer and one process
  • • Delete the container and the writable layer goes with it

The client is not the engine

  • • docker CLI only sends REST calls to dockerd over a unix socket
  • • dockerd delegates to containerd, which calls runc to exec PID 1
  • • Remember this: ECS and Kubernetes replace the client, not the runtime

Isolation, not virtualization

  • • Namespaces decide what the process can see
  • • cgroups and seccomp decide how much it gets and what it may call
  • • No guest OS - every container shares the host kernel