Docker Concepts & Architecture
Difficulty: easy
Overview
Docker is an open-source platform for building, shipping, and running applications in containers.
Containers vs Virtual Machines:
| Feature | Container | Virtual Machine |
|---|---|---|
| OS | Shares host kernel | Full guest OS per VM |
| Startup | Milliseconds | Minutes |
| Size | MBs | GBs |
| Isolation | Process-level (namespaces) | Hardware-level (hypervisor) |
| Density | 100s per host | 10s per host |
Docker Architecture (Client-Server):
- Docker Client (
docker): CLI that sends commands to the daemon via REST API over a Unix socket or TCP. - Docker Daemon (
dockerd): Background service that manages images, containers, networks, and volumes. - containerd: Container runtime that manages the complete container lifecycle (pull, create, start, stop).
- runc: Low-level OCI-compliant runtime that creates and runs containers using Linux namespaces and cgroups.
- Docker Registry: Storage and distribution for Docker images (e.g., Docker Hub, private registries).
Isolation Mechanisms:
- Namespaces: Provide isolation — pid, net, mnt, uts, ipc, user namespaces keep containers separate.
- cgroups (Control Groups): Limit and measure CPU, memory, disk I/O, and network usage per container.
Docker Machine:
Tool to provision Docker hosts on VMs (VirtualBox), cloud providers (AWS, GCP), or bare metal. Largely superseded by Docker Desktop and cloud-native tooling.
Docker Socket:
The daemon listens on /var/run/docker.sock by default. Mounting it into a container grants root-equivalent host access — a critical security consideration.
Practice Linked Questions
Q1. What is the primary difference between a Docker container and a virtual machine?
Select one answer before revealing.
Q2. Which component of Docker is responsible for managing images, containers, networks, and volumes on a host?
Select one answer before revealing.
Q3. Which Linux kernel features does Docker primarily use to provide container isolation and resource limits?
Select one answer before revealing.
Q4. What is the role of containerd in the Docker architecture?
Select one answer before revealing.
Q5. A developer mounts the Docker socket (/var/run/docker.sock) into a container. What is the primary security concern?
Select one answer before revealing.
Q6. What is the purpose of Docker Machine?
Select one answer before revealing.
Q7. Which of the following are benefits of using containers over virtual machines? (Select all that apply — more than one answer may be correct.)
Select one answer before revealing.
Q8. Which of the following correctly describe components of the Docker Engine? (Select all that apply — more than one answer may be correct.)
Select one answer before revealing.
Q9. When you run `docker run ubuntu echo hello` and there is no local ubuntu image, what does Docker do first?
Select one answer before revealing.
Q10. How does the Docker client communicate with the Docker daemon by default on Linux?
Select one answer before revealing.
Q11. Which of the following best describes how Docker uses Linux namespaces?
Select one answer before revealing.