Demystifying Docker: How Containers Work Under the Hood

Introduction

Docker has revolutionized how we build, package, and deploy software. But what actually happens when you run docker run? Is a container just a lightweight virtual machine, or is it something entirely different?

In this post, we will unpack how Docker works under the hood and explore the core Linux features that make containerization possible.

Virtual Machines vs. Containers

To understand Docker, it helps to contrast it with Virtual Machines (VMs):

• Virtual Machines: Include a full guest operating system running on hypervisor-managed virtual hardware. They are resource-heavy and slow to boot.
• Containers: Share the host system's Linux kernel and isolate application processes from the rest of the system. They start in seconds and consume significantly fewer resources.

The Core Building Blocks: Linux Kernel Magic

Docker relies heavily on features built directly into the Linux kernel:

1. Namespaces (Isolation)

Namespaces partition kernel resources so that a group of processes sees one set of resources while another group sees a different set. Key namespaces include:

• PID Namespace: Isolates process IDs (a container thinks its main process is PID 1).
• NET Namespace: Isolates network interfaces and routing tables.
• MNT Namespace: Isolates file system mount points.
• IPC Namespace: Isolates Inter-Process Communication resources.
• UTS Namespace: Isolates hostnames and domain names.

2. Control Groups (cgroups - Resource Control)

Control groups manage and limit hardware resources (CPU, memory, disk I/O) allocated to a container. This prevents a single run-away process from crashing the host system.

3. Layered File Systems (OverlayFS)

Docker images are built using layered file systems like OverlayFS. Each instruction in a Dockerfile creates a read-only layer. When a container starts, Docker adds a thin read-write layer on top. This makes images extremely reusable and storage-efficient.

Docker Architecture

Docker operates on a client-server architecture:

1. Docker CLI: The command-line tool you interact with (e.g., docker run, docker build).
2. Docker Daemon (dockerd): A background service that manages Docker objects like images, containers, networks, and volumes.
3. containerd: An industry-standard container runtime that manages the complete container lifecycle.
4. runc: A lightweight CLI tool that interacts directly with the Linux kernel to create and run containers according to OCI (Open Container Initiative) specs.

Conclusion

Docker isn't magic—it is an elegant abstraction layer on top of Linux kernel primitives like namespaces, cgroups, and layered file systems. By orchestrating these features, Docker provides a consistent, portable, and efficient environment for running applications anywhere.