Docker Architecture

Docker uses a client-server architecture with the main components: Docker Client, Docker Daemon, and Registry.

Main Components

+-------------------+
|  Docker Client    |
|  (CLI/GUI)        |
+-------------------+
        ↓
+-------------------+
|  Docker Daemon    |
|  (dockerd)        |
+-------------------+
        ↓
+-------------------+
|  Containerd       |
+-------------------+
        ↓
+-------------------+
|  Runc             |
+-------------------+

Docker Client

The client sends commands to the daemon:

# CLI commands
docker run -d nginx
docker build -t myapp .
docker ps

# Docker Desktop GUI
# Desktop application for managing containers

Docker Daemon (dockerd)

The daemon receives and executes commands:

# Check the daemon status
sudo systemctl status docker

# View daemon logs
sudo journalctl -u docker

# Restart the daemon
sudo systemctl restart docker

Container Runtime

containerd: Manages the container lifecycle
runc: Runs containers according to OCI specifications

# Check the containerd version
containerd --version

# Check the runc version
runc --version

Image Layering

+-------------------+
|   App Layer       |  <- 10 MB
+-------------------+
|   Dependencies    |  <- 50 MB
+-------------------+
|   Runtime         |  <- 200 MB
+-------------------+
|   Base OS         |  <- 50 MB
+-------------------+

Total: 310 MB (with shared layers)

Union File System

Docker uses UnionFS to merge layers:

# View image layers
docker history nginx:latest

# View layer details
docker inspect nginx:latest

Use Case: Application Architecture

+-------------------+
|  Docker Client    |  <- Developer laptop
|  (CLI)            |
+-------------------+
        ↓
+-------------------+
|  Docker Daemon    |  <- myapp server
|  (dockerd)        |
+-------------------+
        ↓
+-------------------+
|  Container 1      |  <- Frontend
+-------------------+
+-------------------+
|  Container 2      |  <- Backend API
+-------------------+
+-------------------+
|  Container 3      |  <- Database
+-------------------+

Network Architecture

# View available networks
docker network ls

# View network details
docker network inspect bridge

# Create a custom network
docker network create myapp-net

Storage Architecture

# View volumes
docker volume ls

# View bind mounts
docker inspect container_name | grep Mounts

# View storage drivers
docker info | grep "Storage Driver"

Everyday Use Case

Case: An administrator needs to understand the Docker architecture for troubleshooting.

# View Docker system information
docker info

# View space usage
docker system df

# View events
docker events --since="2024-01-01"

Security Model

+-------------------+
|  Namespaces       |  <- Process isolation
+-------------------+
|  Cgroups          |  <- Resource limits
+-------------------+
|  Capabilities     |  <- Permissions
+-------------------+
|  Seccomp          |  <- System call filtering
+-------------------+

Use Case: Security Audit

# View a container's capabilities
docker inspect --format='{{.HostConfig.CapAdd}}' mycontainer

# View security options
docker inspect --format='{{.HostConfig.SecurityOpt}}' mycontainer

# Run with security constraints
docker run -d \
  --security-opt=no-new-privileges \
  --cap-drop=ALL \
  --cap-add=NET_BIND_SERVICE \
  nginx

Best Practices

Understand layer caching: Structure your Dockerfile for optimal caching
Use multi-stage builds: Separate build and runtime
Limit resources: Set CPU and memory limits
Monitor: Use docker stats for monitoring
Backup: Back up important volumes and configurations

Use Case: Monitoring

# Real-time monitoring
docker stats --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}"

# Export metrics for Prometheus
docker run -d \
  --name cadvisor \
  -v /:/rootfs:ro \
  -v /var/run:/var/run:rw \
  -v /sys:/sys:ro \
  -v /var/lib/docker/:/var/lib/docker:ro \
  -p 8080:8080 \
  gcr.io/cadvisor/cadvisor

Conclusion

Understanding the Docker architecture helps with troubleshooting and optimization. Each component plays an important role in running containers efficiently and securely.