1 Welcome to Docker
Docker is introduced as an open-source tool that standardizes how software is packaged, shipped, and run by using containers. It lowers the cost of adopting best practices—such as isolation, reproducibility, and clean installation/removal—by making them the default. Unlike full virtual machines, containers leverage operating system features for process isolation, enabling faster startup and lower resource usage. The chapter argues Docker’s importance lies in its practical abstraction, broad industry support, and the way it simplifies software management in a cross-platform, open way, bringing app-store-like simplicity to servers and developer workflows.
The chapter explains the core model: images are the shippable units that bundle files and metadata; containers are runtime instances of those images. A simple “hello world” walk-through illustrates how Docker fetches an image from a registry and runs it in an isolated process. Under the hood, Docker relies on Linux namespaces, cgroups, capability drops, and security modules to scope access to processes, filesystems, networks, and resources. This approach mitigates dependency conflicts, improves portability (with Mac and Windows using a lightweight Linux VM), and strengthens security by containing the blast radius of misbehaving or malicious programs. Teams benefit through faster scaling, higher CI/CD fidelity, reproducible test environments, and easier developer onboarding with versioned, shareable setups.
Guidance on where to use Docker emphasizes typical server and desktop workloads—web services, databases, command-line tools, and many user applications—while noting limits: it won’t help programs that require full machine access, and it doesn’t natively run non-Linux desktop apps. Used thoughtfully, containers keep systems clean, simplify fleet management, and support defense-in-depth, though untrusted or privileged workloads still demand caution. The chapter situates Docker within a larger ecosystem that includes registries, plugins, and orchestration platforms like Kubernetes, which runs containers built with Docker but adds operational complexity best handled via managed offerings. It closes by highlighting Docker’s built-in command-line help and reiterating the central payoff: a reusable, reliable abstraction that saves time and reduces risk across the software lifecycle.
What happens after running docker run
Running docker run a second time. Because the image is already installed, Docker can start the new container right away.
A basic computer stack running two programs that were started from the command line
Docker running three containers on a basic Linux computer system
Example programs running inside containers with copies of their dependencies Figure 1.5 Dependency relationships of example programs
Figure 1.5 Dependency relationships of example programs
Left: a malicious program with direct access to sensitive resources. Right: a malicious program inside a container.
Summary
This chapter has been a brief introduction to Docker and the problems it helps system administrators, developers, and other software users solve. In this chapter you learned that:
- Docker takes a logistical approach to solving common software problems and simplifies your experience with installing, running, publishing, and removing software. It’s a command-line program, an engine background process, and a set of remote services. It’s integrated with community tools provided by Docker Inc.
- The container abstraction is at the core of its logistical approach.
- Working with containers instead of software creates a consistent interface and enables the development of more sophisticated tools.
- Containers help keep your computers tidy because software inside containers can’t interact with anything outside those containers, and no shared dependencies can be formed.
- Because Docker is available and supported on Linux, OS X, and Windows, most software packaged in Docker images can be used on any computer.
- Docker doesn’t provide container technology; it hides the complexity of working directly with the container software; and turns best practices into reasonable defaults.
- Docker works with the greater container ecosystem; that ecosystem is rich with tooling that solves new and higher-level problems.
- If you need help with a command you can always consult the docker help subcommand.
FAQ
What is Docker?
Docker is an open source platform for building, shipping, and running software. It includes a command-line interface, a background engine, and supporting services that use operating system containers to simplify installing, running, updating, and removing applications.How does the “Hello, World” example work in Docker?
Rundocker run dockerinaction/hello_world. Docker checks for the image locally; if missing, it pulls it from Docker Hub, creates a new container, and runs its default command (which prints “hello world”). The container stops when that command exits. Running the same command again reuses the already-downloaded image but creates a new container each time.What’s the difference between a Docker image and a container (and how are images distributed)?
- Image: a packaged snapshot of files plus metadata (including the default command). It’s the shippable unit you share and pull. - Container: a running (or stopped) instance created from an image. You can start many containers from the same image; their file system changes are isolated from each other. - Distribution: Images are stored and shared via registries and indexes (for example, Docker Hub).docker run will pull from a registry if the image isn’t local.Are containers the same as virtual machines?
No. Virtual machines virtualize hardware and boot full operating systems, which adds startup time and resource overhead. Containers are an OS feature: processes run directly on the host kernel with isolation. They start quickly and are lightweight. The technologies are complementary—Docker on macOS/Windows typically uses a small VM to host Linux containers, and you can run Docker inside VMs in the cloud.How does Docker isolate applications?
Docker builds containers using Linux isolation and security features so processes see only the resources you permit. Key features include: - PID namespace: process IDs/capabilities - UTS namespace: host and domain names - MNT namespace: file system view and mounts - IPC namespace: shared memory communication - NET namespace: networks and interfaces - USER namespace: users and IDs - chroot(): file system root location - cgroups: CPU, memory, and I/O limits - Capability drops: restrict privileged operations - Security modules: mandatory access controls (e.g., AppArmor/SELinux)What problems does Docker solve for developers, operators, and users?
- Dependency conflicts and “it works on my machine” issues via per-app containers - Inconsistent installs and difficult removals by making software packaging declarative and self-contained - Faster scaling: containers start quickly and use fewer resources than VMs - CI/CD: identical images in test and prod improve confidence and speed - Developer onboarding: versioned, reproducible dev environments - Operations: declarative runs, environment-specific configuration, and controlled resource accessWhen and where should I use Docker?
Use it for most Linux-based server and desktop applications (web servers, databases, proxies, CLI tools, etc.) and for Windows applications on Windows Server. It’s great for local development, CI/CD pipelines, production services, and for distributing software to users with a single, portable dependency.What are Docker’s limitations and security caveats?
- Docker runs Linux software on most systems; macOS/Windows desktop apps aren’t run natively in Docker. Native Windows apps require Windows Server containers. - Containers aren’t a complete security solution and won’t help software that must run with full machine privileges. - Don’t run untrusted or privileged containers in multi-tenant environments without strong controls.How can I get help with Docker commands?
Usedocker help for top-level syntax and available commands. For detailed usage of a specific command, run docker help <command> (for example, docker help cp).
Docker in Action, Second Edition ebook for free
