Docker Architecture Simplified

Many a time you would have seen people comparing a container to a VM, which according to me and many others is a questionable

VM has a full-blown OS in which running and application are run on top it.
Containers on the other can be considered as an isolated process which use the primitive Linux kernel features like Namespaces and Cgroups

Also, the startup time for both VM and a container vary a lot where a container starts up in mili seconds, a VM take a few seconds to even minutes.

Now let's see the high-level architecture of Docker

In the lower layer we Linux kernel providing the primitive features of namespace and cgroups

Then we have container runtimes - we will talk about these later

On top, we have a docker engine that provides the restful interface for the client to interact


Namespace in Linux defines what a process can see and docker utilized this to abstract resources like a filesystem, network, process tree, etc.

That is why when you start a container, it starts with its onset of namespaces for eg: PID namespace, the primary process in any container has a PID of 1 but if you look at it from host's point of view, it will have some different PID.

Cgroup on the other defines what a process can use and help in limiting resource utilization, resources like CPU time, memory bandwidth, etc.

Runc and containerd the runtimes. Docker engine is built on top of this
It is the runtime that takes care of this abstraction of namespace and cgroups within a container.

Another Linux primitive that is very important for implementation docker is Union Filesystem or UnionFs

UnionFS enables dockers to efficiently manage the storage of image layers.

UnionFS presents multiple filesystems as union mounts and their files and directories are referred to as branches that are overlaid to create a single filesystem