47.3 Docker architecture: client, daemon, containerd, runc, registry

Example 1: See the client and server parts

Type this:

docker version

You will see:

Client: Docker Engine - Community
 Version:           27.3.1
Server: Docker Engine - Community
 Engine:
  Version:          27.3.1
 containerd:
  Version:          1.7.22
 runc:
  Version:          1.1.14

What it means: One command shows two sides: Client (the waiter) and Server (the kitchen). The server part also lists containerd and runc, which we meet next.

Example 2: Find where the client program lives

Type this:

which docker

You will see:

/usr/bin/docker

What it means: The client is just one program file. It can even live on a different computer from the engine, which we use in lesson 47.14.

Example 3: Client with no engine

Type this:

sudo systemctl stop docker docker.socket
docker ps

You will see:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

What it means: The waiter is here, but the kitchen is closed. Start it again with sudo systemctl start docker. This is the most common Docker error for beginners.

Example 4: Check that the daemon is running

Type this:

systemctl is-active docker

You will see:

active

What it means: systemctl controls background services on Linux. "active" means the manager is in the kitchen.

Example 5: See the daemon process

Type this:

ps -e -o pid,comm | grep -E 'dockerd'

You will see:

1102 dockerd

What it means: The daemon is a normal Linux process with an ID number (PID). Your number will differ.

Example 6: Read the daemon's own log

Type this:

sudo journalctl -u docker --since '10 min ago' | tail -3

You will see:

level=info msg="Loading containers: done."
level=info msg="Docker daemon" version=27.3.1
level=info msg="API listen on /run/docker.sock"

What it means: When something goes wrong, read this log first. The last line tells us where the daemon listens for the client: a socket file, our next step.

Example 7: Look at the socket file

Type this:

ls -l /var/run/docker.sock

You will see:

srw-rw---- 1 root docker 0 Oct 25 09:10 /var/run/docker.sock

What it means: The first letter s means socket. Only root and the docker group may use it. That is why you add your user to the docker group (lesson 47.5).

Example 8: Talk to the daemon without the docker client

Type this:

curl -s --unix-socket /var/run/docker.sock http://localhost/version | head -c 120

You will see:

{"Platform":{"Name":"Docker Engine - Community"},"Version":"27.3.1","ApiVersion":"1.47"...

What it means: curl sends a request through the socket. We got the same version as docker version. This proves the docker command is just a client of this API.

Example 9: List containers through the API

Type this:

curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json

You will see:

[]

What it means: An empty list, same as an empty docker ps. Tools like Portainer and Jenkins plugins use exactly this API.

Example 10: See containerd running

Type this:

systemctl is-active containerd
ps -e -o pid,comm | grep containerd

You will see:

active
   988 containerd

What it means: containerd is its own background service, separate from dockerd.

Example 11: See Docker's containers through containerd

Type this:

docker run -d --name web nginx:1.27
sudo ctr -n moby containers ls

You will see:

CONTAINER                                                           IMAGE    RUNTIME
6f0c...                                                             -        io.containerd.runc.v2

What it means: ctr is containerd's own small client. Docker keeps its containers in a group called moby. The same container appears here too.

Example 12: Docker still works when dockerd restarts

Type this:

sudo systemctl restart docker
docker ps --format '{{.Names}} {{.Status}}'

You will see:

web Up 40 seconds

What it means: With the setting live-restore turned on in /etc/docker/daemon.json, containers keep running while dockerd restarts. Without it, they restart with the daemon. Big teams at Swiggy turn this on so a daemon upgrade does not drop traffic.

Example 13: Find the runc program

Type this:

runc --version

You will see:

runc version 1.1.14
spec: 1.2.0

What it means: runc follows a public standard called OCI (Open Container Initiative), so other tools like Podman use it too.

Example 14: See the shim that owns your container

Type this:

ps -ef | grep containerd-shim | grep -v grep | head -1

You will see:

root  2210  1  0 09:31 ?  00:00:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 6f0c...

What it means: One shim per container. Its parent is process 1, not dockerd. That is why the container does not die with dockerd.

Example 15: See the container's real process

Type this:

docker inspect --format '{{.State.Pid}}' web
ps -p $(docker inspect --format '{{.State.Pid}}' web) -o pid,comm

You will see:

2235
  PID COMMAND
 2235 nginx

What it means: The nginx inside the container is process 2235 on the host. In the end, every container is just a process the kernel walls off.

Example 16: See which registry is the default

Type this:

docker info --format '{{.IndexServerAddress}}'

You will see:

https://index.docker.io/v1/

What it means: When you do not give a registry name, Docker uses Docker Hub.

Example 17: Pull from a named registry

Type this:

docker pull public.ecr.aws/nginx/nginx:1.27

You will see:

1.27: Pulling from nginx/nginx
Status: Downloaded newer image for public.ecr.aws/nginx/nginx:1.27

What it means: The part before the first slash is the registry address. This image came from Amazon's public registry instead of Docker Hub.

Example 18: See where images are stored on disk

Type this:

sudo du -sh /var/lib/docker

You will see:

1.4G    /var/lib/docker

What it means: Every pulled image and every container lives under this folder on the host. Never delete files here by hand; use Docker commands such as docker image prune.

Example 19: Terminal 1: start watching

Type this:

docker events --format '{{.Type}} {{.Action}} {{.Actor.Attributes.name}}'

You will see:

(waiting...)

What it means: The command waits. Leave it open.

Example 20: Terminal 2: run a container

Type this:

docker run --rm --name demo alpine echo hi

You will see:

hi

What it means: A tiny container runs and is removed.

Example 21: Back in terminal 1: the chain

Type this:

docker events (output)

You will see:

image pull alpine
container create demo
network connect bridge
container start demo
container die demo
container destroy demo

What it means: Pull, create, connect to a network, start, die, destroy. This is the full life of a container, step by step, exactly as in Picture 1. Press Ctrl+C to stop watching.

Example 22: No permission on the socket

Type this:

docker ps

You will see:

permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

What it means: The daemon is fine, but your user is not in the docker group. Fix it with sudo usermod -aG docker $USER, then log out and back in. Never fix it by making the socket world-writable.

Example 23: containerd is stopped

Type this:

sudo systemctl stop containerd
docker run --rm alpine echo hi

You will see:

docker: Error response from daemon: failed to create task for container: connection refused: unavailable.

What it means: dockerd got the order but could not reach the head chef. Start it with sudo systemctl start containerd and run the command again.

Example 24: The registry cannot be reached

Type this:

docker pull nginx:1.27

You will see:

Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io: no such host

What it means: The store room is closed or the server has no internet or DNS. Check with curl -I https://registry-1.docker.io/v2/. In a private AWS network, teams at Netflix use a VPC endpoint to reach ECR instead.