Docker architecture and terms

The parts

• Image — a read-only template made of layers: code, runtime, libraries. The full name looks like registry/repository:tag, for example docker.io/library/nginx:1.27.
• Container — a running (or stopped) instance created from an image. One image can run as many containers.
• Docker Engine — the Docker CLI (docker) plus the Docker daemon (dockerd). The CLI only sends requests over the Docker API (socket /var/run/docker.sock); the daemon manages images, containers, networks and volumes (using containerd and runc underneath).
• Registry — a service that stores images: Docker Hub (public), or private ones such as Harbor, Amazon ECR, Azure ACR. A repository is a "slot" in a registry holding many tags of one image (nginx has 1.27, 1.27-alpine…).

Build → Ship → Run

flowchart LR
  DF["Dockerfile + source"] -- "docker build" --> IMG["Image"]
  IMG -- "docker push" --> REG[("Registry")]
  REG -- "docker pull" --> H2["Another host"]
  H2 -- "docker run" --> C["Container"]

On Linux, Docker runs natively. On Windows/macOS, Docker Desktop runs the daemon inside a small Linux VM.

If docker version prints only the Client section and then Cannot connect to the Docker daemon, the daemon is not running or your user has no access to the socket (not in the docker group).

Engine, Desktop, and installation

Docker Engine (the open-source daemon and CLI) is what you install on Linux servers, normally from Docker's own apt or dnf repository rather than the older docker.io distro package. Docker Desktop bundles Engine, a Linux VM, Compose, and a GUI for Windows and macOS; it is free for personal use, education, and small businesses, but larger companies need a paid subscription. docker info shows the storage driver, number of containers, and daemon settings.

Configuring the daemon

The daemon reads /etc/docker/daemon.json, for example to set a registry mirror, the default logging driver, or the address pool for networks. Restart it with sudo systemctl restart docker after changes. Docker contexts (docker context create, docker context use) point the CLI at another daemon over SSH, so one laptop can manage several hosts.

The socket is powerful

Anyone who can talk to /var/run/docker.sock can start a privileged container and become root on the host. Adding a user to the docker group is therefore equivalent to giving them root. Mounting the socket into a container (common for CI tools) carries the same risk. Rootless mode runs the daemon as a normal user to reduce this exposure.

Tags, digests, and platforms

A tag such as nginx:1.27 is a movable label: the publisher can point it at a new build. A digest such as nginx@sha256:... identifies exact content and never changes, so pinning by digest gives reproducible deployments. Many images are multi-arch: one tag refers to a manifest list with variants for linux/amd64 and linux/arm64, and Docker pulls the one matching your CPU. docker image inspect nginx:1.27 --format '{{.Architecture}}' shows what you got.