🐳 How Docker Works

Before typing any command, understand what a container actually is — and what happens under the hood when you run one.

1. The Problem Docker Solves

"It works on my machine!" — the oldest excuse in software. Your app needs a specific Python version, specific libraries, specific config. The server has different ones. Docker fixes this by packing the app plus everything it needs into one sealed box — a container — that runs identically on any machine with Docker installed.

📦 Shipping analogy (the actual origin of the logo): Before shipping containers, loading a ship took days — barrels here, crates there, everything handled differently. The standardized shipping container changed everything: pack anything inside, and every crane, truck and ship in the world can handle it. Docker does that for software: your app is packed once, and any laptop, server or cloud can run it.

2. Containers vs Virtual Machines

A VM ships a whole guest operating system for each app. Containers share the host's OS kernel and isolate only what's needed — so they start in seconds and weigh megabytes, not gigabytes:

VIRTUAL MACHINES (heavy) Physical server + Host OS Hypervisor App A Libs GUEST OS(~ GBs!) App B Libs GUEST OS(~ GBs!) App C Libs GUEST OS(~ GBs!) CONTAINERS (light) Physical server + Host OS (ONE kernel, shared) 🐳 Docker Engine App A Libs App B Libs App C Libs No guest OS — starts in seconds, MBs not GBs ✅
Virtual MachineContainer
Boot timeMinutesSeconds (often < 1s)
SizeGigabytesMegabytes
OSFull guest OS eachShares host kernel
IsolationHardware-level (stronger)Process-level (lighter)
DensityA few per serverDozens–hundreds per server

3. The Architecture — Client, Daemon, Registry

Three players are involved every time you use Docker:

4. Animated: What Happens on docker run nginx

Press ▶ Play and follow the request through the whole system:

$ docker run nginx Docker CLI (client) REST API request 🐳 Docker daemon idle 💾 Local images ubuntu, redis … (no nginx) ☁️ Docker Hub (registry — image app store) pull if missing 📦 CONTAINER nginx process (PID 1) own filesystem (from image) not created yet create + start container
Ready — press Play to run "docker run nginx".
The 5 steps: ① CLI sends the request to the daemon → ② daemon checks local images → ③ not found? pull from Docker Hub → ④ create a container from the image → ⑤ start the process inside it. Second time you run it, step ③ is skipped — the image is cached locally.

5. Image vs Container — the #1 Beginner Confusion

🎂 Analogy: An image is the recipe + all ingredients, frozen (read-only, shareable, stored on disk). A container is the cake actually baking — a live, running instance. From one image you can run 10 containers, just like one recipe can bake 10 cakes.
ImageContainer
StateRead-only templateLive, running (or stopped) instance
Created bydocker build / docker pulldocker run / docker create
Listed withdocker imagesdocker ps -a
How manyOne per app versionAs many as you want from the same image

6. Vocabulary You'll See Everywhere

TermMeaningAnalogy
ImageRead-only app template (app + libs + OS files)Frozen recipe
ContainerRunning instance of an imageCake being baked
DockerfileText file with instructions to build an imageThe written recipe
RegistryServer storing/sharing images (Docker Hub)Cookbook store
TagVersion label on an image (nginx:1.25)Edition number
DaemonBackground engine doing the real workThe kitchen staff
VolumePersistent storage outside the containerThe pantry (survives)

🧠 Checkpoint

Answer all 3, then check. Explanations appear either way.
1. A container and a virtual machine both isolate an application. What is the essential difference?
A VM boots a full guest operating system on virtual hardware, which is why it takes a minute to start. A container is just a process on the host kernel with its own view of the filesystem, network and process tree — which is why it starts in milliseconds.
2. Which two kernel features give a container its isolation and its limits?
Namespaces decide what a process can SEE (its own filesystem, network, PIDs). cgroups decide what it can USE (CPU, memory). Docker is largely a friendly interface over those two kernel features.
3. You run the same image on Ubuntu and on CentOS and the app behaves identically. Why?
The image bundles the libraries and files the app needs. The host only provides the kernel — which is also why a Linux container cannot run on a Windows kernel without a Linux VM underneath.
🔓 You're reading a free chapter of Docker — the first two are open.
Unlock the rest of this course with a one-time payment.
Unlock this course →
🔓 See course prices