The previous post about virtualization and containerization brought up some underlying technologies which Docker build containers on, including:
- namespaces – a Linux kernel mechanism to isolate resources. It allows a process to run within an isolated environment (mnt, pid, net, ipt, uts, user, cgroup)
- cgroups – a Linux kernel mechanism to limit resource usage of a process or process group
- unionFS (this will be further discussed under Docker storage)
In this post we further discuss the components in Docker, the dominant and popular player in container technology, as shown in the diagram below:
The component names can be seen under docker install directory. It consists of three groups:
- Docker related: docker, dockerd, docker-init and docker-proxy
- Containerd related: containerd, containerd-shim and ctr
- Container runtime: runc
Now we discuss each group:
Docker-related components
docker is just an implementation of docker client, it supports commands to achieve all functions between client and server. Alternatively, user may use REST API, or Docker SDK to communicate with Docker server.
dockerd is the server process, to receive requests from docker (client), SDK library or REST API caller. It executes the request and returns status to client. There are three ways for docker (client) to communicate with dockerd.
- By Unix Socket (unix://socket_path). The default socket path used by dockerd is /var/run/docker.sock, which is why only root can use docker after installation.
- TCP request (tcp://host:port). It is recommended to configure TLS communication in production environment.
- By file descriptor (fd://) used in systemd service.
Unix socket is the default communication method. To allow remote access to dockerd, use -H to specify HOST and PORT when starting dockerd.
docker-init is used by Docker as PID 1 process for containers, in case it needs to recycle zombie containers. To use this, specify –init when running container.
docker-proxy is used for port mapping. When you use -p switch with docker run, this docker-proxy is the service that maps the container port to host port. It does so by modifying the iptables nat rule.
Containerd related components
containerd component was separated from dockerd since Docker 1.11, in compliance with OCI standard. It is responsible for life cycle management of containers, it also manages images (e.g. pulling from repo), request from dockerd to call runc, storage and network resources.
dockerd uses UNIX socket to send request to containerd. The default socket path for containerd is /run/containerd/containerd.sock. containerd execute the task and return status to dockerd. You may also directly use containerd to manage containers.
ctr (containderd-ctr) is the client of containerd, mostly used only in development and testing. If the environment does not have dockerd, then you can use ctr as client, to send request directly to containerd.
containerd-shim is used to decouple containerd from the containers. containerd-shim is the parent process of containers. This is so that restarting containerd does not impact the running containers.
Container runtime
runc is a standard implementation of OCI container runtime. It is a command-line tool to create and run containers.