Beginner LevelDocker & Deployment
What is the Docker Daemon (dockerd) and REST API architecture?
❓ Interview Prompt: Explain the Docker architecture: CLI → REST API → dockerd → containerd → runc execution chain.
Docker follows a client-server architecture with several distinct components in the execution chain:
Execution Chain:
docker CLI → REST API → dockerd → containerd → runc → container process
Components:
1
Docker CLI (
docker): Client tool that translates commands into HTTP requests.2
Docker REST API:
dockerd exposes a REST API over:•
Unix socket:
/var/run/docker.sock (local, default).•
TCP:
tcp://host:2376 (remote, TLS required).3
dockerd (Docker Daemon): The primary background service — manages images, containers, networks, volumes. Delegates container execution to
containerd.4
containerd: An OCI-compliant container runtime daemon (also used by Kubernetes). Manages container lifecycle — pulling images, creating snapshots, starting/stopping.
5
runc: The low-level OCI runtime that actually creates the Linux namespaces and cgroups and starts the container process.
Security Note:
The Unix socket /var/run/docker.sock provides root-equivalent access — never mount it into untrusted containers.
Code Implementation Example
bash
# The Docker CLI is just an API client — same as calling the REST API directly:
# CLI command:
docker ps
# Equivalent REST API call via curl (Unix socket):
curl --unix-socket /var/run/docker.sock http://localhost/containers/json | jq
# Check the daemon socket location
ls -la /var/run/docker.sock
# srw-rw---- 1 root docker ... /var/run/docker.sock ← unix socket file
# View dockerd logs
journalctl -u docker.service -f
# Configure dockerd via /etc/docker/daemon.json
cat /etc/docker/daemon.json
# {
# "log-driver": "json-file",
# "log-opts": { "max-size": "10m", "max-file": "3" },
# "default-ulimits": { "nofile": { "Name": "nofile", "Hard": 64000, "Soft": 64000 } }
# }💡The Docker CLI calls the dockerd REST API over a Unix socket — equivalent to direct curl API calls.
🎯 Interview Key Takeaway
Docker CLI → REST API (Unix socket) → dockerd → containerd → runc. The /var/run/docker.sock grants root-equivalent access — protect it carefully.
#Docker#dockerd#Architecture#REST API#containerd#Beginner
Back to all Docker & Deployment Questions→