41 lines
2.2 KiB
Markdown
41 lines
2.2 KiB
Markdown
---
|
|
categories:
|
|
- DevOps
|
|
tags: [docker, containerization]
|
|
---
|
|
|
|
# Docker architecture
|
|
|
|
## Overview
|
|
|
|
|
|
|
|
- The Docker Client is a thin API for making [REST API](/Databases/REST/RESTful_APIs.md) to the Docker Server. Any CLI command beginning `docker...` is an API request to the server.
|
|
- The internal process name for the server is `dockerd`.
|
|
- On `docker run...`, `dockerd` calls `containerd`. This process starts the container runtimes and configures container-level storage and networking.
|
|
- This then spawns `container-shim` procecesses which takes any output from you container and puts it in a logfile. (A redirection of `stdout` and `stderr`) One shim is spawned for each container.
|
|
- The shim then launches a container runtime called `runc`. The `runc` performs all the complex configuration of cgroups and namespaces to create the container environment.
|
|
- `containerd` is purely a bootstrapper. Once it has fulfilled its function by initiating `runc`, the Docker instance is up and running and the kernel takes it from there. It is like a launch scaffold that can be discarded.
|
|
|
|
> If you are running Docker desktop on Mac or Windows, Docker creates a Linux virtual machine, since it cannot run natively on Windows or Mac. In these cases the the Docker Server runs inside this VM adding an additional layer of abstraction.
|
|
|
|
> Docker server also creates an internal virtual network and assigns IP addresses to the containers. (This can be used to get containers to communicate to each other over TCP/IP, since they are isolated by default.)
|
|
|
|
## Images
|
|
|
|
Containers are created from images stored in a registry (either the public Docker Hub or privately). `containerd` uses the image to tell `runc` how to construct and build the image.
|
|
|
|
```sh
|
|
docker run [image_name]
|
|
```
|
|
|
|
The images you have pulled from the registry are stored in a local registry on your machine.
|
|
|
|
When you run `docker run`, Docker will look first for the image in your local registry. If it cannot find it there, it will attempt to pull it from the remote registry.
|
|
|
|
This assumes you are using a third-party image. You can also create your own images by writing a Dockerfile:
|
|
|
|
```sh
|
|
docker build [docker_file]
|
|
docker run [resulting_image]
|
|
```
|