Keyboard Shortcuts N Next post
P Previous post
S Save / unsave
R Read aloud
T Toggle theme
/ Focus search
Esc Close panels
🔥
Ready to read...
Architecture Docker Docker & Containers: From Zero to Production Docker Basics Module 1 — Container Fundamentals

Docker Architecture — Client, Daemon, and Registry Explained

Reviewed & accurate
AI Summary
R Ram Pothuraju Reading…

What You'll Learn

Beginner

  • The three main components of Docker's architecture
  • How the client, daemon, and registry interact
  • What happens when you type docker run
  • Why Docker uses a client-server architecture
Docker CLI docker run... docker build... REST API dockerd (Daemon) Containers Images Networks / Volumes pull/push Registry Docker Hub Private Reg Docker Host You type here Work happens here Images stored here
Docker Architecture — Client sends commands, Daemon does the work, Registry stores images

The Three Components

1. Docker Client (docker)

The Docker client is the command-line tool you type commands into. It's the user-facing interface.

Terminalbash
$ docker run ubuntu
docker: the client CLI

The client doesn't do any real work — it sends commands to the daemon via a REST API. It's the "waiter" that takes your order and passes it to the kitchen.

2. Docker Daemon (dockerd)

The Docker daemon (dockerd) is the background service that does all the actual work:

  • Builds images
  • Pulls and pushes images from/to registries
  • Creates and manages containers
  • Manages networks and volumes

The daemon runs as a background process (usually as root) and listens for API requests from the client.

3. Docker Registry

A registry is a storage service for Docker images. The most common is Docker Hub (hub.docker.com), but you can also use:

  • Private registries (self-hosted or cloud-managed)
  • Cloud provider registries (AWS ECR, Google GCR, Azure ACR)
  • GitHub Container Registry (ghcr.io)

What Happens When You Run docker run ubuntu

You type docker run ubuntu in the terminal.
Client sends a REST API request to the daemon: "create a container from the ubuntu image".
Daemon checks if the ubuntu image exists locally.
If not found locally, daemon pulls it from Docker Hub (the default registry).
Daemon creates a new container from the image — adds a writable layer, sets up namespaces and cgroups.
Daemon starts the container — the entrypoint process begins.
Client streams the container's output back to your terminal.
docker run ubuntu — step by step 1. docker run ubuntu 2. daemon checks local cache 3. pull from registry 4. create container (layers + namespaces) 5. start container (run entrypoint) 6. stream output to terminal
The flow of docker run — client to daemon to registry and back

Client-Server Communication

The client and daemon communicate via a REST API over a Unix socket (on Linux) or a named pipe (on Windows). By default:

Default socketbash
# Linux/macOS
/var/run/docker.sock

# Windows
//./pipe/docker_engine

The client can also connect to a remote daemon over TCP (useful for CI/CD or managing remote Docker hosts):

Remote daemonbash
DOCKER_HOST=tcp://remote-server:2376 docker ps
Security note
The Docker socket gives full root access to the host. Never expose it unauthenticated. If you must connect remotely, use TLS certificates.

Docker Hub — The Default Registry

Docker Hub (hub.docker.com) is the default public registry. When you run docker pull ubuntu, Docker pulls from docker.io/library/ubuntu.

Official vs community images

TypeExampleDescription
Official imagesubuntu, nginx, postgresCurated by Docker, Inc. No namespace prefix.
User imagesmyuser/myappUploaded by individual users. Has username prefix.
Verified publishersmicrosoft/dotnetVerified by Docker as official from the vendor.

Other Docker Components

Beyond the three main components, Docker includes:

ComponentPurpose
containerdContainer runtime — manages container lifecycle (Docker uses it internally)
runcLow-level container runtime — creates and runs containers per OCI spec
docker buildxExtended build capabilities (multi-platform, advanced caching)
docker composeMulti-container orchestration (covered in Module 6)

Common Mistakes

Avoid these
  • Confusing client and daemon. docker (the CLI) is just a client. dockerd (the daemon) does the work. If docker ps fails, the daemon might not be running.
  • Thinking Docker Hub is the only registry. Many organizations use private registries (AWS ECR, Harbor, GitHub Container Registry) for security and performance.
  • Exposing the Docker socket. Mounting /var/run/docker.sock into a container gives that container root access to the host. Only do this for trusted images.
  • Forgetting the daemon runs as root. The Docker daemon needs root privileges. This is a security consideration in multi-tenant environments.

Practical Exercise (5 minutes)

Run docker version — see separate client and daemon versions
Run docker info — see daemon details (storage driver, registry, containers running)
Run docker pull alpine — explicitly pull an image without running it
Run docker images — see the image in your local cache
Run docker run alpine echo "hello" — notice it doesn't need to pull (already cached)

Mini Challenge

Run docker info and find: (1) what storage driver your Docker uses, (2) how many containers are running, (3) the default registry configured. Understanding docker info output is essential for troubleshooting.

Key Takeaways

  • Docker has three main components: client (CLI), daemon (dockerd), and registry (image store).
  • The client sends commands; the daemon does the work; the registry stores images.
  • docker run = client sends API request → daemon checks cache → pulls if needed → creates container → starts it.
  • Docker Hub is the default registry, but you can use private or cloud registries too.
  • The Docker socket gives root access — never expose it unauthenticated.
Previously: Lesson 03 covered the kernel features behind containers.
Today: You learned the Docker architecture: client, daemon, registry.
Next: Lesson 05 shows how to install Docker on macOS, Windows, and Linux.

FAQ

Can the client and daemon be on different machines?

Yes. Set DOCKER_HOST to point the client at a remote daemon. This is common in CI/CD pipelines where the build runs on one machine and Docker runs on another. Use TLS for security.

What's the difference between Docker Engine and Docker Desktop?

Docker Engine is the open-source daemon + CLI that runs on Linux. Docker Desktop is a commercial product for macOS and Windows that includes Docker Engine inside a Linux VM, plus a GUI and additional tools. On Linux, you typically install Docker Engine directly.

Test Your Knowledge
How did you find this?

Comments

Join the discussion! Sign in with your Google or Blogger account, or comment as Anonymous - no account needed. For quick questions, also reach me on Telegram @cytestch.

Comments

Post a Comment