Docker chevron_right Day 3: Docker Architecture - Daemon, CLI, Images, Containers

Day 3: Docker Architecture - Daemon, CLI, Images, Containers

calendar_today schedule 10 min read

Learning Objectives: By the end of this lesson, you will be able to:

  • Explain the relationship between Docker daemon, CLI, images, and containers
  • Understand the client-server architecture of Docker
  • Differentiate between images and containers clearly
  • Describe the lifecycle of containers from image to running state

1. Welcome and Introduction (5 minutes)

Icebreaker Activity

Yesterday you successfully ran your first Docker container! But have you ever wondered what actually happened behind the scenes? It’s like watching a magician pull a rabbit out of a hat - the magic is in understanding how all the pieces work together.

Lesson Overview

  • Duration: 60-75 minutes
  • Prerequisites: Completed Days 1-2, Docker installed and working
  • Materials Needed: Computer with Docker installed, terminal/command prompt access

2. Learning Objectives and Session Outline (5 minutes)

What We’ll Cover Today:

  1. Docker Client-Server Architecture - How components communicate
  2. Docker Daemon Deep Dive - The engine that makes it all work
  3. Images vs. Containers - Understanding the fundamental difference
  4. Container Lifecycle - From creation to destruction
  5. Docker Registry Interaction - How images are stored and shared

Success Criteria:

By the end of this session, you should be able to draw the Docker architecture and explain how a simple docker run command works at each layer.

3. Foundation Knowledge (15-20 minutes)

Core Concepts

Docker’s Client-Server Architecture

Docker follows a client-server model where different components have specific responsibilities:

Docker Client (CLI):

  • The interface you interact with
  • Sends commands to the Docker daemon
  • Can connect to local or remote daemons
  • Translates user commands into API calls

Docker Daemon (dockerd):

  • The server component running in the background
  • Manages Docker objects (images, containers, networks, volumes)
  • Listens for Docker API requests
  • Can communicate with other daemons

Real-World Analogy: Think of the Docker CLI as a TV remote control and the Docker daemon as the TV itself. The remote (CLI) sends signals (commands) to the TV (daemon), which then performs the actual work of changing channels, adjusting volume, etc.

Images vs. Containers - The Blueprint vs. Building Relationship

This is often the most confusing concept for beginners, so let’s make it crystal clear:

Images:

  • Read-only templates containing application code, libraries, dependencies, and configuration
  • Layered file systems that are immutable once created
  • Can be shared and reused across different environments
  • Stored in registries like Docker Hub

Containers:

  • Running instances of images with an added writable layer
  • Include isolated processes, file systems, and network interfaces
  • Can be started, stopped, deleted without affecting the original image
  • Ephemeral by nature - designed to be disposable

Key Terminology

  • Docker Daemon (dockerd): Background service managing Docker objects
  • Docker Client: Command-line interface for interacting with Docker
  • Image Layer: Individual layers that make up a Docker image
  • Container Layer: Writable layer added on top of image layers when container runs
  • Registry: Service for storing and distributing Docker images
  • Repository: Collection of related Docker images with different tags

4. Detailed Explanation and Examples (25-30 minutes)

Understanding Docker’s Architecture Components

The Docker Daemon in Detail

The Docker daemon is the heart of the Docker system. It’s responsible for:

  1. Image Management: Pulling, building, and storing images
  2. Container Lifecycle: Creating, starting, stopping, and removing containers
  3. Network Management: Creating and managing container networks
  4. Volume Management: Handling persistent data storage
  5. API Server: Providing REST API for client communication

The daemon runs with root privileges and binds to a Unix socket (or TCP socket) to listen for API requests.

How the CLI Communicates with the Daemon

# When you run this command:
docker run nginx

# Here's what happens:
# 1. CLI parses the command
# 2. CLI sends HTTP request to daemon via Unix socket
# 3. Daemon checks if nginx image exists locally
# 4. If not, daemon pulls from registry
# 5. Daemon creates container from image
# 6. Daemon starts the container
# 7. CLI displays output from daemon

The Layered Nature of Images

Docker images are built in layers, which provides several benefits:

  • Efficiency: Layers can be shared between images
  • Caching: Unchanged layers don’t need to be rebuilt
  • Distribution: Only changed layers need to be transferred
[Application Layer]     ← Your app code
[Dependencies Layer]    ← npm install, pip install, etc.
[Runtime Layer]        ← Node.js, Python, etc.
[Base OS Layer]        ← Ubuntu, Alpine, etc.

Container Runtime Process

When you create a container, Docker:

  1. Takes the read-only image layers
  2. Adds a thin writable layer on top
  3. Creates isolated namespaces for the process
  4. Sets up network interfaces
  5. Applies resource constraints (if specified)
  6. Starts the main process

Common Misconceptions

  1. Misconception: Containers are like lightweight VMs Reality: Containers are isolated processes that share the host kernel, not separate operating systems

  2. Misconception: Each container has its own copy of the image Reality: All containers from the same image share the same read-only layers, only adding their own writable layer

  3. Misconception: The Docker daemon and CLI must be on the same machine Reality: Docker CLI can connect to remote daemons, enabling distributed Docker management

5. Live Coding Demonstration (20-25 minutes)

Example 1: Exploring Docker Architecture

# Check Docker daemon status
docker system info
# Shows detailed information about daemon configuration

# View Docker API version
docker version
# Shows both client and server (daemon) versions

# Monitor Docker events in real-time (run in separate terminal)
docker system events

# In another terminal, run a container and watch events
docker run --rm alpine echo "Hello from Alpine"

Explanation:

  • docker system info: Reveals daemon configuration, storage driver, and system resources
  • docker version: Shows client-server architecture with separate versions
  • docker system events: Real-time stream of daemon activities

Example 2: Understanding Images and Layers

# Pull an image and examine its layers
docker pull nginx:alpine

# View image layers
docker history nginx:alpine

# Inspect detailed image information
docker inspect nginx:alpine

# Create container without starting it
docker create --name my-nginx nginx:alpine

# Examine container details
docker inspect my-nginx

# Start the container
docker start my-nginx

# View the writable layer changes
docker diff my-nginx

Key Points:

  • Image layers are read-only and shared
  • Container adds a writable layer
  • docker diff shows changes in the container’s writable layer
  • Same image can create multiple containers

Example 3: Container Lifecycle Management

# Create and run a container in one command
docker run -d --name web-server nginx:alpine

# Check container status
docker ps

# View container logs
docker logs web-server

# Execute command in running container
docker exec -it web-server /bin/sh
# (Exit with 'exit' command)

# Stop the container
docker stop web-server

# Check stopped containers
docker ps -a

# Restart the container
docker restart web-server

# Remove the container
docker rm -f web-server

# Verify removal
docker ps -a

Debugging Docker Communication

# Check if daemon is running
docker info

# View daemon logs (varies by OS)
# Linux: journalctl -u docker.service
# macOS/Windows: Docker Desktop > Troubleshoot > Get support

# Test daemon connectivity
docker ping docker.io

# View Docker system usage
docker system df

6. Hands-On Practice (30-40 minutes)

Exercise 1: Architecture Exploration (15 minutes)

Objective: Understand the relationship between Docker components

Instructions:

# 1. Examine your Docker system
docker system info | grep -E "(Server Version|Storage Driver|Kernel Version)"

# 2. Check what images you have
docker images

# 3. See all containers (running and stopped)
docker ps -a

# 4. Pull a new image and watch the layers
docker pull python:3.9-slim

# 5. Examine the image layers
docker history python:3.9-slim

# 6. Create multiple containers from the same image
docker run -d --name python1 python:3.9-slim sleep 300
docker run -d --name python2 python:3.9-slim sleep 300

# 7. Compare the containers
docker inspect python1 | grep -A5 "MergedDir"
docker inspect python2 | grep -A5 "MergedDir"

Questions to Answer:

  1. How many layers does the python:3.9-slim image have?
  2. Do python1 and python2 containers share the same image layers?
  3. What’s different between the two containers at the filesystem level?

Exercise 2: Image vs. Container Experiment (10 minutes)

Objective: Clearly understand the difference between images and containers

Experiment:

# Start with a clean slate
docker run --rm -it alpine:latest /bin/sh

# Inside the container, make some changes:
# echo "Hello Docker" > /tmp/testfile.txt
# exit

# The container is gone (--rm flag), changes are lost

# Now create a persistent container
docker run -it --name test-container alpine:latest /bin/sh

# Inside the container:
# echo "Persistent data" > /tmp/persistent.txt
# exit

# Container still exists but is stopped
docker ps -a

# Restart and check if changes persist
docker start test-container
docker exec test-container cat /tmp/persistent.txt

# Clean up
docker rm test-container

Key Learning Points:

  • Images are immutable templates
  • Containers add a writable layer
  • Container changes persist until container is deleted
  • Multiple containers from same image are independent

Exercise 3: Docker Daemon Interaction (15 minutes)

Objective: Understand how CLI communicates with daemon

Advanced Exploration:

# 1. Check Docker daemon socket (Linux/macOS)
ls -la /var/run/docker.sock

# 2. Use curl to directly interact with Docker API (Linux/macOS)
curl --unix-socket /var/run/docker.sock http://localhost/version

# 3. Monitor daemon activity
docker system events &
EVENT_PID=$!

# 4. Perform various Docker operations and watch events
docker pull hello-world
docker run --rm hello-world
docker images

# 5. Stop monitoring
kill $EVENT_PID

# 6. Check Docker system resource usage
docker system df
docker system df -v  # Verbose output

Windows PowerShell Alternative:

# Monitor Docker events
Start-Job -ScriptBlock { docker system events }

# Perform operations and check events
docker pull hello-world
docker run --rm hello-world

# Check job output
Get-Job | Receive-Job

# Clean up
Get-Job | Remove-Job

7. Common Pitfalls and Troubleshooting (10 minutes)

Frequent Architecture Misunderstandings

  1. Problem: Confusing image modifications with container modifications Cause: Not understanding that images are immutable Solution: Remember that changes happen in the container’s writable layer, not the image

  2. Problem: Expecting containers to persist data after removal Cause: Not understanding container lifecycle Solution: Use volumes for persistent data or commit container changes to new images

  3. Problem: Docker daemon not responding Cause: Daemon crashed, insufficient permissions, or resource constraints Solution:

    # Check daemon status
systemctl status docker  # Linux
# Restart Docker Desktop (Windows/macOS)

# Check for permission issues
groups $USER | grep docker  # Should include docker group

Debugging Communication Issues

  • CLI can’t connect to daemon: Check if Docker Desktop is running (Windows/macOS) or daemon service is active (Linux)
  • Permission denied errors: Ensure user is in docker group (Linux) or Docker Desktop has proper permissions
  • Slow responses: Check available disk space and memory

8. Best Practices and Professional Tips (5 minutes)

Architecture Understanding Benefits

  • Troubleshooting: Understanding components helps diagnose issues faster
  • Performance: Knowing layer sharing optimizes image building and storage
  • Security: Understanding daemon privileges informs security decisions
  • Scaling: Client-server model enables distributed Docker management

Professional Development Tips

  • Learn Docker API: Understanding the API helps with automation and tooling
  • Monitor Resource Usage: Regularly check docker system df and docker system prune
  • Use Remote Daemons: Learn to connect CLI to remote Docker hosts for production management

Security Considerations

  • Daemon Socket Security: The Docker daemon socket provides root access
  • Image Trust: Verify image sources and use image signing when possible
  • Container Isolation: Understand that containers share the kernel

9. Summary and Review (5 minutes)

Key Takeaways

  1. Docker uses client-server architecture with CLI sending commands to the daemon
  2. Images are immutable templates while containers are running instances with writable layers
  3. Layer sharing makes Docker efficient for storage and distribution

Quick Review Questions

  1. What’s the role of the Docker daemon in the overall architecture?
  2. Explain the difference between an image and a container in terms of file system layers.
  3. What happens when you run docker run nginx from an architecture perspective?

Visual Summary

[Docker CLI] ──API calls──> [Docker Daemon] ──manages──> [Images]
                                   │                        │
                                   └─────creates────> [Containers]
                                   │
                                   └─────pulls from──> [Registry]

For Instructors

Teaching Tips

  • Use visual diagrams extensively - architecture concepts are easier to understand visually
  • Emphasize the client-server model with practical examples
  • Use analogies consistently (blueprint/building, template/instance)
  • Demonstrate the same operation from both CLI and daemon perspective

Assessment Ideas

  • Draw the Docker architecture diagram from memory
  • Explain what happens during docker run step by step
  • Compare and contrast images vs. containers in a table
  • Troubleshoot a broken Docker daemon scenario

Adaptation Notes

  • Visual learners: Create flowcharts and architecture diagrams
  • Hands-on learners: Focus more on the practical exercises
  • Advanced students: Introduce Docker API and remote daemon concepts
  • Beginners: Use more analogies and spend extra time on image vs. container distinction

Time Management

  • Architecture explanation: 30 minutes maximum
  • Hands-on practice: 40-50% of class time
  • Q&A and troubleshooting: Reserve 15 minutes

Common Student Questions

Q: “Why do I need to understand this architecture?” A: It helps with troubleshooting, optimization, and understanding Docker’s capabilities and limitations.

Q: “Can containers modify the original image?” A: No, images are read-only. Containers create a separate writable layer.

Q: “What happens to container data when I restart my computer?” A: Stopped containers persist until explicitly removed, but running containers will stop and need to be restarted.