Docker and containerd

The Docker Architecture

When you run docker run, you are not running a single program. You are triggering a chain of components that each handle a specific responsibility. Understanding this chain helps you debug issues, choose the right runtime for your environment, and understand the broader container ecosystem.

Docker CLI

The Docker CLI is the client you interact with. It translates commands like docker run and docker build into API calls to the Docker daemon. The CLI itself does not create containers — it sends requests over a Unix socket or TCP connection.

# The default socket location on Linux
ls -la /var/run/docker.sock

# The CLI sends API requests to the daemon
docker version

# If the daemon is not running, you get a connection error
# Cannot connect to the Docker daemon at unix:///var/run/docker.sock

dockerd (Docker Daemon)

dockerd is the Docker daemon — a persistent process that manages Docker objects: images, containers, networks, and volumes. It receives API requests from the CLI and coordinates with containerd to create and manage containers. On modern Docker, dockerd handles image management, networking, and the API, then delegates container lifecycle to containerd.

containerd

containerd is an industry-standard container runtime. It manages the complete container lifecycle on a host: image transfer and storage, container execution and supervision, low-level storage, and network attachments. Docker uses containerd as its core runtime, but containerd can also be used directly.

# containerd runs as a system service
systemctl status containerd

# Kubernetes uses containerd directly (without Docker)
# /etc/containerd/config.toml is its config file

# ctr is containerd's CLI tool
ctr images ls
ctr containers ls

runc and the OCI Spec

runc is the low-level container runtime that actually creates and runs containers. It reads an OCI (Open Container Initiative) runtime specification that describes the container: its root filesystem, namespaces, cgroups, capabilities, and environment. runc implements the spec and hands off to the Linux kernel to create the container process.

# When you run:
docker run -d nginx:alpine

# The actual chain is:
# 1. CLI sends API request to dockerd
# 2. dockerd tells containerd to create a container
# 3. containerd calls runc with an OCI bundle
# 4. runc creates namespaces, cgroups, and mounts
# 5. runc execves the container's entrypoint
# 6. runc exits — containerd supervises the process

Alternatives to Docker

Docker is not the only container runtime. Podman provides a Docker-compatible CLI without a daemon. containerd can be used directly with ctr or nerdctl. Kubernetes uses containerd or CRI-O. Understanding the ecosystem helps you choose the right tool for your use case.

# Podman is daemonless and rootless
podman run -d nginx:alpine

# Same CLI as Docker
podman ps
podman images

# Can use Dockerfiles directly
podman build -t myapp .