docker is a client. The work happens in a daemon that runs as root.
text
you client engine (root)
+-------+ docker ps +---------+ HTTP API +---------+ +------------+ +------+
| shell | -----------> | docker | -----------> | dockerd | --> | containerd | --> | runc | --> container process
+-------+ | CLI | over the +---------+ +------------+ +------+
+---------+ unix socket │
/var/run/docker.sock │ pull
v
registry (docker.io)| Component | Role |
|---|---|
docker (CLI) | Parses your command, sends an API request, prints the reply |
/var/run/docker.sock | Unix socket the engine listens on |
dockerd | The : images, containers, networks, volumes, pulls |
containerd | Manages container lifecycles for dockerd |
runc | Creates the namespaces and cgroups, then starts the process |
The client and engine can be on different machines. In this course they are on the same host.
docker version: two sections
sh
docker versiontext
Client: Docker Engine - Community
Version: 27.3.1
API version: 1.47
...
Context: default
Server: Docker Engine - Community
Engine:
Version: 27.3.1
API version: 1.47 (minimum version 1.24)
containerd:
Version: 1.7.22
runc:
Version: 1.1.14Client describes the CLI binary. Server is the engine's reply. If only Client prints, the CLI could not reach the engine.
docker info: the engine's state
sh
docker info| Field | Meaning |
|---|---|
Containers: 0 / Running / Stopped | Containers the engine knows about |
Images: 0 | Images in the local store |
Storage Driver: overlay2 | How image layers are stacked into one filesystem |
Cgroup Version: 2 | Which cgroup interface limits resources |
Docker Root Dir: /var/lib/docker | Where images and containers are stored |
Who may use the socket
sh
ls -l /var/run/docker.sock
idtext
srw-rw---- 1 root docker 0 Oct 11 20:40 /var/run/docker.sock
uid=1000(learner) gid=1000(learner) groups=1000(learner),27(sudo),988(docker)The socket is owned by root:docker with mode 660. Only root and members of the docker group can connect. A user outside the group sees:
text
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.47/containers/json": dial unix /var/run/docker.sock: connect: permission deniedTwo fixes:
| Fix | Command | When |
|---|---|---|
| Run as root | sudo docker ps | One-off, on a shared server |
| Join the group | sudo usermod -aG docker learner | Your own workstation or a build host |
Keep -a in usermod -aG. Without it, -G replaces every supplementary group, and you lose sudo.
A new group membership applies to new login sessions. On a real server, log out and back in (or run newgrp docker) before docker ps works without sudo.