Containers, images and registries

The "works on my machine" problem

A developer builds an API with Python 3.12 and a certain version of a PDF library. On the test server, Python is 3.10 and the library is older, so invoice generation crashes. Every machine is slightly different: operating system version, installed packages, environment variables. Containers solve this by shipping the app together with its environment, so the thing you tested is exactly the thing you run.

Containers versus virtual machines

A virtual machine (VM) pretends to be a whole computer. It runs a complete guest operating system with its own kernel (the core of the operating system that talks to the hardware) on top of a hypervisor. A container is much lighter: it is a normal process on the host, but fenced off so it sees only its own files, processes and network. All containers on a host share the host's kernel.

Two Linux kernel features make containers possible. Namespaces control what a process can SEE: its own process list, network interfaces, mount points, hostname and user IDs. Control groups (cgroups) control how much it can USE: CPU, memory, disk I/O and number of processes. Because Linux containers need a Linux kernel, Docker Desktop on Windows and macOS runs a small Linux VM in the background (on Windows, usually through WSL 2).

Images and containers

An image is a read-only template: a file system (for example a slim Debian plus Python plus your code) and settings such as which command to run. A container is a running instance of an image. From one image you can start ten identical containers. When a container is removed, anything it wrote inside itself is gone, while the image stays unchanged.

Layers and copy-on-write

An image is made of layers. Each instruction in a Dockerfile that changes files (such as RUN, COPY or ADD) adds a layer containing just those changes. Layers are shared: if ten images use the same python:3.12-slim base, those base layers are stored and downloaded only once. When a container starts, Docker adds a thin writable layer on top. If the container changes a file from the image, the file is first copied up into the writable layer and changed there. This is copy-on-write, and it is why starting a container is so fast: nothing is copied in advance.

Registries, names and tags

A registry is a server that stores images. Docker Hub (docker.io) is the default public one. Others include GitHub Container Registry (ghcr.io), Amazon ECR, Google Artifact Registry and Azure Container Registry, and companies often run private ones. An image reference has up to three parts: registry, repository and tag.

nginx:1.27-alpine
  registry:   docker.io (the default when none is given)
  repository: library/nginx (official images live under library/)
  tag:        1.27-alpine

ghcr.io/acme/shop-api:2.3.1
  registry:   ghcr.io
  repository: acme/shop-api
  tag:        2.3.1

python            → docker.io/library/python:latest

Docker Engine, CLI and Desktop, and OCI

• Docker Engine: the background service (dockerd) that builds and runs containers on a Linux host.
• Docker CLI: the docker command you type; it sends requests to the engine.
• Docker Desktop: an app for Windows, macOS and Linux that bundles the engine, CLI, Compose and a GUI. It is free for personal use, education and small businesses; larger companies need a paid subscription (check the current terms).
• OCI (Open Container Initiative): open standards for image formats, runtimes and registries. Because of OCI, images built with Docker also run on containerd, Podman and Kubernetes.

docker version                 # client and engine versions
docker pull nginx:1.27-alpine  # download an image from the registry
docker images                  # list local images
docker run --rm -p 8080:80 nginx:1.27-alpine   # start a container, remove it when it stops

Common mistakes

• Thinking a container is a small VM and installing SSH, cron and many services in it. One container should run one main process; start more containers for more services.
• Storing important data only inside a container. When it is removed, the data is gone. Use volumes (covered later).
• Expecting a Linux image to run natively on Windows or an x86 image on an ARM Mac. Images are built for a CPU architecture; multi-platform images include several.