Docker Fundamentals: Images, Containers, and Writing a Good Dockerfile

The Docker Engine's Moving Parts

"Docker" is really several cooperating pieces, and knowing the split explains some otherwise-confusing behavior:

• Docker CLI (docker) — the command you type. It doesn't do the work itself; it sends requests to the daemon.
• Docker daemon (dockerd) — a background process (usually running as root) that actually builds images, starts containers, manages networks and volumes. The CLI talks to it over a socket.
• containerd — a lower-level daemon dockerd delegates container lifecycle management to; it's also usable directly by other tools (this is the same containerd Kubernetes uses under containerd-based clusters).
• runc — the actual low-level component that creates a container's namespaces and cgroups and starts its process — the thing that does the kernel-level work at the bottom of the stack.

Practically, the layering means docker run is a client request, not a self-contained action: docker (client) talks to dockerd (daemon) which talks to containerd which talks to runc which does the actual isolation. This is also why the daemon needing to restart (a Docker Desktop update, for instance) can interrupt containers even though you never touched them directly — they're managed by a process independent of your terminal session.