TOPIC CONTAINERS
Docker package apps with their entire runtime into lightweight boxes
IN 10 SECONDS
A `Dockerfile` describes each layer — OS base, dependencies, app code, start command. `docker build` creates a cached image; `docker run` launches a container from it. Each container is an isolated process with its own filesystem, network, and PID namespace.
GOTCHA Container != VM. They share the host kernel — a `syscall` in the container is a syscall on the host. You can't run a different OS kernel inside a container.
HOW A CONTAINER STARTS
01 Docker client sends a `run` command to the Docker daemon (`dockerd`).
02 Daemon checks if the image is cached locally; if not, pulls layers from a registry.
03 Daemon creates a new writable container layer on top of the image layers (copy-on-write).
04 containerd + runc set up cgroups (CPU/memory limits), namespaces (isolation), and the root filesystem, then execute the entrypoint.
05 Process runs inside the container. When it exits, the container stops (unless `--restart` is set).
POKE IT YOURSELF
docker ps -a — list all containers, including stopped
docker exec -it CONTAINER sh — get a shell inside a running container
Drill this topic →
~80 sec read