Questions
1 of 4
1Discuss The Docker daemon.
2What is Docker Engine and how does it work internally?
3What is the difference between Docker CLI and Docker Daemon?
4How do you harden a Docker daemon for production?
DockerDocker
Basics
Engine
Container
Images
Hub
Dockerfile
Volumes and Storage
Compose
CI-CD
Security
Performance
Using Docker
01 / 04

Discuss The Docker daemon.

The Docker daemon (dockerd) listens for Docker API requests and manages Docker objects such as images, containers, networks, and volumes. A daemon can also communicate with other daemons to manage Docker services.

The Internal Hierarchy (The Modern Stack)
  1. 1

    dockerd (The High-Level Controller): Handles the API, authentication, and high-level networking/volumes.

  2. 2

    containerd (The Manager): A CNCF-graduated project that manages the container lifecycle (transferring images, executing containers, supervising them).

  3. 3

    containerd-shim: A tiny process that sits between containerd and the running container. It allows the daemon to be restarted or upgraded without killing the running containers.

  4. 4

    runc (The Runtime): The low-level tool that actually interacts with the Linux Kernel to create the container using Namespaces and Cgroups.

The Role of dockerd
  1. 1

    Listening for API Requests: It provides a standard Docker Engine API (REST) that the Docker Client (CLI) or third-party tools (like Portainer or VS Code) call.

  2. 2

    Object Management: It handles the creation and cleanup of Docker objects (Images, Containers, Networks, and Volumes).

  3. 3

    Image Management: It manages the local image cache and coordinates with registries (like Docker Hub or Amazon ECR) to pull or push layers.

Communication Channels
  1. 1

    Unix Socket (/var/run/docker.sock): The default. It’s the most secure because it only allows local communication.

  2. 2

    Systemd Socket: Used on modern Linux distributions to start the daemon on demand.

  3. 3

    TCP Socket: Allows you to control Docker remotely (e.g., controlling a production AWS instance from your local terminal). Warning: This must be secured with TLS/SSL in production to prevent unauthorized access.

Advanced Configuration (daemon.json)
  1. 1

    data-root: Changing where Docker stores images and containers (useful if your root partition is small).

  2. 2

    registry-mirrors: Speeding up docker pull by using a local mirror.

  3. 3

    default-ulimits: Setting resource limits for all containers at the daemon level.

  4. 4

    insecure-registries: Allowing the daemon to connect to a private registry without a valid SSL certificate (common in internal dev environments).