Docker explained: how containers work

Docker is a set of products that uses operating system-level virtualization to deliver software in packages called containers. It automates the deployment of applications inside lightweight containers, so the same software runs consistently across different machines. The core software that runs and manages these containers is called Docker Engine, and it was first released as open source in 2013.

What a container is

A container is a standardized, encapsulated environment that runs an application. Containers are isolated from one another and bundle their own software, libraries, and configuration files; they can communicate with each other through well-defined channels. A program running inside a container can only see the container's contents and the devices assigned to it — not the whole host computer.

Containers are built on OS-level virtualization, a paradigm in which the operating system kernel allows multiple isolated user-space instances to exist on a single machine. On Linux, containers are based on the virtualization, isolation, and resource management mechanisms of the Linux kernel itself, notably Linux namespaces and cgroups. Namespaces isolate an application's view of the operating environment — process trees, network, user IDs, and mounted file systems — while cgroups limit the resources a container may use, such as memory and CPU.

Because all containers on a machine share the services of a single operating system kernel, they use fewer resources than virtual machines. Docker containers are lightweight: a single server or virtual machine can run several containers simultaneously. A 2018 analysis found that a typical Docker use case involves running eight containers per host, and that a quarter of analyzed organizations run 18 or more per host.

Docker vs virtual machines

Virtual machines (VMs) run a full guest operating system on top of a hypervisor such as VMware, Hyper-V, or QEMU. OS-level virtualization is different: containers share the host kernel and use the operating system's normal system call interface, so they avoid the overhead of emulation or an intermediate virtual machine.

The trade-off is flexibility: OS-level virtualization cannot host a guest operating system different from the host one. With Linux, different distributions work fine, but an OS such as Windows cannot be hosted as a container on a Linux kernel. Docker on macOS works around this by running a Linux virtual machine to host the containers. Windows, for its part, has native support for running Linux containers through the Windows Subsystem for Linux (WSL 2).

The history of Docker

Docker began as an internal project within dotCloud, a platform-as-a-service company. Solomon Hykes started the project in France; dotCloud itself was founded by Kamel Founadi, Hykes, and Sebastien Pahl during the Y Combinator Summer 2010 startup incubator, launched in 2011, and was renamed Docker Inc. in 2013.

Docker debuted to the public at PyCon in Santa Clara in 2013 and was released as open source in March 2013. At the time it used LXC as its default execution environment; one year later, with version 0.9, Docker replaced LXC with its own component, libcontainer, written in the Go programming language.

Adoption followed quickly. In September 2013 Red Hat and Docker announced a collaboration around Fedora and Red Hat Enterprise Linux; in October 2014 Microsoft announced the integration of the Docker engine into Windows Server; in June 2015 Docker and several other companies announced work on a vendor- and operating-system-independent standard for software containers, which became the Open Container Initiative. Docker for Mac and Windows betas arrived in March 2016, and native Docker use on Windows 10 followed in June 2016.

How Docker is put together: daemon, client, images, containers

Docker has three main parts, plus a registry:

• Daemon — dockerd is a persistent process that manages Docker containers and handles container objects. It listens for requests sent via the Docker Engine API.
• Client — the docker command-line interface lets users interact with Docker daemons.
• Objects — the entities used to assemble an application: images, containers, and services. An image is a read-only template used to build containers; images are used to store and ship applications. A container is a running instance created from an image.
• Registries — a registry is a repository for images. Docker clients connect to registries to pull images for use or push images they have built. Registries can be public or private; the main public registry and Docker's default is Docker Hub.

In day-to-day use the flow is: build an image from a Dockerfile, push it to a registry, then run containers from that image on any machine with Docker installed. Because the image already bundles the application and its dependencies, the same image runs the same way in development, staging, and production.

Dockerfiles: images as text

A Dockerfile is a text file that specifies what goes into an image: the base Linux distribution, installation commands for the programming language runtime and application source code. Because the image definition is plain text, it can be version-controlled and reviewed like any other code.

FROM ubuntu:24.04
COPY ./examplefile.txt /examplefile.txt
ENV MY_ENV_VARIABLE="example_value"
RUN apt-get update
# Mount a directory from the Docker volume
VOLUME ["/myvolume"]
# Expose a port (22 for SSH)
EXPOSE 22

Each instruction creates a layer; Docker reuses unchanged layers from its local cache, which is why rebuilding an image after a small change is fast.

Docker Compose: multi-container applications

Docker Compose is a tool for defining and running multi-container Docker applications. It uses YAML files to configure the application's services and performs the creation and start-up of all the containers with a single command. The docker-compose.yml file declares services with options such as build (the Dockerfile path) and command (overriding default container commands).

The first public beta of Docker Compose was released on December 21, 2013; the first production-ready version 1.0 followed on October 16, 2014.

Orchestration: Docker Swarm and beyond

Docker Swarm provides native clustering functionality for Docker containers, turning a group of Docker engines into a single virtual Docker engine. Since Docker 1.12, Swarm mode is integrated with Docker Engine. Swarms are managed with the Raft consensus algorithm: for an update to be performed, the majority of swarm nodes need to agree on it.

Swarm is one of several orchestration tools. Kubernetes, originally developed by Google, became the dominant container orchestration platform and runs containers in pods across clusters of machines. Docker and Kubernetes are complementary in practice: Docker builds and runs the containers, Kubernetes schedules and manages them at scale.

Volumes: keeping data when containers die

Containers are ephemeral by design — files written inside a container disappear when it is removed. Docker Volumes solve this by separating data from the container lifecycle: a volume persists independently, so data remains even after the container is deleted or re-created.

Licensing and pricing

Docker Engine is licensed under the Apache License 2.0. Docker Desktop, the GUI application for macOS and Windows, distributes some components under the GNU General Public License and is not free for large enterprises: since August 2021, Docker Desktop requires a paid subscription for larger business customers, replacing the free plan with a Personal Plan. Docker Engine on Linux distributions remained free.

FAQ

Is Docker a virtual machine?

No. Docker runs containers that share the host operating system kernel, using Linux namespaces and cgroups for isolation. Virtual machines run a complete guest operating system on a hypervisor, which costs more resources but can run a different OS.

Is Docker free?

Docker Engine and the Docker CLI are open source under the Apache License 2.0 and free to use. Docker Desktop is free for individuals and small businesses (Personal Plan), but requires a paid subscription for larger enterprises.

What is the difference between an image and a container?

An image is a read-only template — the packaged application and its dependencies. A container is a running instance created from that image. You can build one image and run many containers from it.

What is Docker Hub?

Docker Hub is the main public registry for Docker images: Docker's default place where images are pulled from and pushed to. Registries can also be private, for proprietary images.