Docker is a container engine for developing, managing, and running containerized applications on a single machine. Its ecosystem includes a command-line client, a daemon, containerd, OCI runtimes, images, and registries. section 1.1 section 1.3.3
A Docker command normally connects to the Docker daemon through a REST API. The daemon stores pulled images, communicates with containerd, and relies on an OCI runtime such as runc to launch the container's initial process. section 1.3.3
Client-server execution path
The path is Docker client → Docker daemon → containerd → OCI runtime → PID 1. The container is a descendant of containerd rather than the client, so the kernel does not treat it as a child of the user's command session. section 1.3.3
Docker provides familiar container workflows, but its daemon model creates important operational and security boundaries:
- Pulls and runs OCI and Docker images from registries such as quay.io and docker.io. section 1.3.1
- Offers a simple command-line interface shared with Podman and supports REST APIs for remote tools and languages, including docker-compose. section 1.3.1 section 1.5
- Places container control behind a daemon; failures in the daemon chain can affect all running containers and complicate diagnosis. section 1.3.3
- Treats access to docker.sock as highly privileged: a user can mount the host filesystem, disable container security with --privileged, and obtain host root access. section 1.3.2
