Unlock Docker: Core Architecture, Technologies, and Runtime Flow Explained

Docker is an open‑source application container engine that lets developers package applications and their dependencies into a container, enabling one‑time build and run anywhere.

Docker Core Principles

Docker containers are built from images and run in isolated environments.

Docker Architecture

Docker consists of three layers: client, daemon, and container runtime components.

Core Components

Docker Client : command‑line tool (docker run, docker build).

Docker Daemon (dockerd) : background service that creates containers and manages images.

containerd / runc : handles container lifecycle and low‑level execution.

Image Registry : stores images (e.g., Docker Hub, Harbor).

Core Technologies

Docker achieves “second‑level startup, high isolation, and high reuse” by leveraging three major Linux kernel features.

Linux Namespaces

Provide process‑level isolation so each container appears as an independent system.

PID – process isolation

NET – separate network stack

MNT – filesystem isolation

UTS – hostname isolation

IPC – inter‑process communication isolation

Linux Cgroups

Limit CPU, memory, I/O, and other resources used by a container to prevent resource starvation.

docker run -m 512m --cpus=1 nginx

UnionFS

Uses a layered read‑only filesystem; each layer can be shared across images, with a writable layer added at runtime.

FROM ubuntu:20.04   # base layer
RUN apt install nginx   # second layer
RUN echo "Hello" > /index.html   # third layer

Docker Runtime Flow

The runtime proceeds as follows:

CLI parses the command and calls the Docker daemon via REST API.

Daemon forwards the request to containerd, which creates the container.

containerd invokes runc, which uses Linux namespaces and cgroups to set up isolation and resource limits, and mounts the UnionFS layers.

runc starts the container’s main process (e.g., nginx).

Docker daemon continuously monitors the container’s state, resources, and network.

In summary, Docker combines namespace isolation, cgroup throttling, and UnionFS layering to deliver lightweight process‑level virtualization.