Most people use Docker without understanding how it works internally. Knowing the architecture helps you debug issues faster and understand why certain commands behave the way they do.
The Three Main Components
Docker Client — The docker CLI you type commands into. When you run docker run nginx, the client sends that instruction to the daemon.
Docker Daemon (dockerd) — The background process that does the actual work. It manages images, containers, networks, and volumes.
Docker Registry — Where images are stored. Docker Hub is the default public registry.
When you type docker pull nginx, the client tells the daemon to pull the nginx image, and the daemon contacts Docker Hub to download it.
Docker Client
# Every command goes through the client
docker pull nginx # Client -> Daemon: pull this image
docker run nginx # Client -> Daemon: create and start container
docker ps # Client -> Daemon: list containers
docker build -t myapp . # Client -> Daemon: build from Dockerfile
# Connect to a remote Docker daemon
export DOCKER_HOST=tcp://remote-server:2376
docker ps # Lists containers on the remote server!
Docker Daemon
# Check daemon status
sudo systemctl status docker
# Daemon manages:
# - Images (stored in /var/lib/docker/overlay2)
# - Containers (running and stopped)
# - Networks (bridge, host, overlay)
# - Volumes (persistent data storage)
# Daemon uses Linux kernel features:
# namespaces: isolation (pid, net, mnt, uts, ipc)
# cgroups: resource limits (CPU, memory, disk I/O)
# Check daemon info
docker info
Docker Registry
# Docker Hub (default public registry)
docker pull nginx # pulls nginx:latest
docker pull nginx:1.25 # specific version
docker pull ubuntu:22.04
# Image naming convention:
# registry/namespace/repository:tag
# docker.io/library/nginx:latest (full name)
# nginx:latest (shorthand)
# Private registries:
# AWS ECR: 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1
# Azure ACR: myregistry.azurecr.io/myapp:v1
# Login to a private registry
docker login myregistry.azurecr.io
# Push image to registry
docker tag myapp:v1 myregistry.azurecr.io/myapp:v1
docker push myregistry.azurecr.io/myapp:v1
What Happens When You Run docker run nginx
# Step 1: Client receives command
docker run -d -p 8080:80 nginx
# Step 2: Client sends API request to daemon
# Step 3: Daemon checks if image exists locally
# If not found: pulls from Docker Hub
# Step 4: Daemon creates container
# Sets up namespaces for isolation
# Sets up cgroups for resource limits
# Creates network interface
# Step 5: Daemon starts the container process
# nginx starts listening on port 80 inside container
# Step 6: Port mapping set up
# Host port 8080 -> Container port 80
# Step 7: Container is running!
curl http://localhost:8080 # Works!
Why This Matters
Understanding Docker architecture helps you:
✅ Debug "connection refused" errors (daemon not running?)
✅ Understand why docker commands need sudo (socket permissions)
✅ Know where images are stored (/var/lib/docker)
✅ Set up remote Docker hosts
✅ Choose the right registry for your team
Article 3 — Docker Images vs Containers
Next up: the most fundamental concepts in Docker that beginners confuse. Once you understand the difference, everything else makes sense.
535+ DevOps interview questions covering Docker, Kubernetes, AWS, Terraform at devopsrise.vercel.app — free, no login required.
Top comments (0)