The daemon that actually builds, runs, and manages containers under the hood.
Docker Engine is a client-server system: dockerd (the daemon) does the real work — building images, running containers, managing networks and volumes — while the docker CLI is a thin client that talks to it over a REST API, typically through a Unix socket, or TCP for remote access. Underneath dockerd sits containerd, which handles the actual container lifecycle (starting, stopping, pausing), and containerd in turn delegates to runc, an OCI-compliant low-level runtime that does the real work of creating an isolated process using Linux primitives.
This layered architecture is what makes several things click into place: why rootless Docker is possible, why alternative runtimes like gVisor exist for stronger isolation, and why 'docker' the CLI, containerd, and runc are versioned and can behave somewhat independently. At the OS level, a container is fundamentally just a regular Linux process with restricted visibility via namespaces and resource limits enforced via cgroups — not a lightweight virtual machine, despite how often that comparison gets made.
What you'll walk away knowing