Docker:

• What it is :
  • Docker is a platform that helps you package, ship, and run applications easily and consistently, no matter where you deploy them (your laptop, a server, the cloud …)
• How it works:
  • It does this by using containers, which are like small, lightweight “virtual machines” — but faster and more efficient. Each container includes everything your app needs: the code, libraries, settings..
  • that means no more “it works on my machine” problems

Docker Isolation:

• Namespaces:

  • Docker relies on Linux kernel features to isolate containers from each other and from the host system. One of the most important of these features is the namespace.

    Namespaces provide isolation — they make a container think it's running on its own system, even though it's actually sharing the host kernel with other containers and the host itself.

  Here are the main types of namespaces Docker uses:

  Namespace	Description
  pid	Isolates the process ID number space (each container has its own process tree).
  net	Provides each container with its own network interfaces and routing table.
  mnt	Gives each container its own filesystem mount points.
  ipc	Isolates inter-process communication (e.g., shared memory) between containers.
  uts	Allows containers to have their own hostname and domain name.
  user	Isolates user and group ID mappings between the host and container.

  So when you run a container, Docker creates these namespaces for it. This is how containers stay isolated — they don’t share their process tree, network stack, filesystem, or even hostname with other containers or the host.

• Cgroups:

  • Cgroups, short for control groups, are a feature in the Linux kernel that provide resource isolation and allocation for processes. Cgroups allow you to control and limit the resources (such as CPU, memory, disk I/O, and network bandwidth) that a group of processes can use.

    When it comes to Docker containers, cgroups play an important role in resource management and isolation. Docker leverages cgroups to allocate and limit system resources for each container, preventing one container from monopolizing system resources and impacting the performance of other containers or the host system.

Docker engine:

• What it is :
  • Docker Engine is the core technology behind Docker — its what makes everything in Docker work. It uses a client-server architecture to manage and run the containers
• How it works:
  • Docker Daemon (dockerd):
    • Fist, a daemon in general is a background process that runs continuously usually without user interaction, to perform specific tasks or services.
    • In our case, it builds, run, and manages containers / Handles Docker objects like images, volumes, and networks / Listens for Docker API requests
  • Docker Client:

    • This is the command-line-tool you use to talk to the daemon; when you run something like:

      docker run nginx
      

      The client sends this request to the daemon, which then :

      • pulls the image (if it doesnt exist)
      • creates a container from it
      • Runs the container

      They communicate using REST API, using UNIX socket or a network connection.

Docker image:

• What it is:
  • A Docker Image is like a blueprint of your application and everything it needs to run (you can think of it as a recipe for a cake — it tells docker how to bake (run) a container)
• Whats inside a docker image:
  • the code or app you want to run
  • The dependencies
  • libraries
  • System-level files and tools
  • A default a command that tells docker what to do when a container starts

Docker Container:

• What it is:
  • A Docker container is a running instance of a Docker image, meaning it includes everything the image had but now its running in isolation from your host machine.
• Key Characteristics:
  • Isolated: Each container runs in its own environment. It has its own file system, processes, network interfaces..
  • Lightweight: Containers share the host system’s kernel, making them faster and lighter than virtual machines.
  • Ephemeral: By default, when a container stops, any data created inside it is lost (unless you use volumes)

Dockerfile: