Docker Architecture

Docker uses a client-server model where the CLI client talks to the Docker daemon, which builds, runs and manages containers and images.

Docker uses a client-server architecture. Understanding its pieces makes every later command clearer.

The main parts

  • Docker client — the docker command you type. It sends requests to the daemon.
  • Docker daemon (dockerd) — the background service that actually builds images, runs containers and manages resources.
  • Images — read-only templates used to create containers.
  • Containers — running instances of images.
  • Registry — a store of images, such as Docker Hub, that you push to and pull from.
Docker client, daemon and registry client-server architectureDocker Clientdocker CLIDocker Host (daemon)ImagesContainersRegistryDocker HubREST APIpull/push
The client sends commands to the daemon over a REST API; the daemon pulls and pushes images to registries.

How a command flows

When you run docker run nginx, the client sends the request to the daemon. If the image is not present locally, the daemon pulls it from a registry, then creates and starts the container.

Example

Example · bash
# Ask the daemon for system-wide information
docker info

# List images the daemon is storing locally
docker images

When to use it

  • A developer understands why docker build commands go to the daemon so they can debug slow remote builds.
  • An ops engineer configures a remote Docker daemon so developers on laptops build images directly on a powerful build server.
  • A security team audits the Docker socket knowing that anything with access to /var/run/docker.sock has root-equivalent power.

More examples

Show daemon and client info

Illustrates the client-server split: the CLI is the client, and the daemon runs separately as the server.

Example · bash
# Client version and server (daemon) info
docker version

# Detailed daemon configuration
docker info | head -30

Connect to a remote Docker daemon

Shows how the Docker client communicates with a daemon running on a different host over SSH.

Example · bash
# Point the CLI at a remote daemon over SSH
export DOCKER_HOST=ssh://[email protected]
docker info
docker ps

Query the daemon REST API

Demonstrates that the daemon exposes a Unix socket REST API, which the CLI uses under the hood.

Example · bash
ls -la /var/run/docker.sock

# Query the daemon REST API directly via the Unix socket
curl --unix-socket /var/run/docker.sock http://localhost/version

Related

docker introdocker registries intro

Discussion

  • Be the first to comment on this lesson.