Chapter 2. Introduction to containers and orchestration with Kubernetes 23
The Docker architecture includes the following components:
/SM590000Docker Server Daemon
Daemon is the Docker process that runs as background process and listen for API 
requests. It also manages Dockers objects, such as images, containers, networks, and 
volumes. 
/SM590000Docker Registry
A Docker registry stores Docker images. Docker Hub is a public registry that anyone can 
use. Docker is configured to look for images on Docker Hub by default. 
/SM590000Docker Objects: 
– Images: This template is re ad-only with instruction to build a Docker container. An 
image can be layer on another image with specific changes. An images library is 
available from the Docker registry. 
A Dockerfile contains the configuration information that is needed to build and run an 
image. Based on instructions that are defined in the Dockerfile, layers are created for 
an image. During the build process, only the changed layer is rebuilt; therefore, Docker 
remains lightweight, which makes it small and fast. 
– Container: A container is an executable inst ance that is built from the image, which can 
be started, stopped, moved, or deleted by using Docker API or CLI. Containers can be 
connected to one or many networks. Storage can be added and a new container can 
be built by using a container.
– Services: Services allow you to scale containers across multiple Docker daemons, 
which all work together as a swarm with multiple managers and workers. Each member 
of a swarm is a Docker daemon, and the daemons all communicate by using the 
Docker API. 
– NameSpace: In context of Docker, NameSpace is the technology that provides isolated 
workspaces for a container (see Table 2-1). Each container encapsulates all its 
features within the namespace that is associated with that specific container. 
Table 2-1   NameSpace
– Control groups: A control group (cgroup) is th e technology that limits an application to a 
specific set of resources. This feature allows Docker Engine to share available 
hardware resources to containers and optionally enforce limits and constraints. 
– Union file system: Union f ile systems (UnionFS) are file systems that operate by 
creating layers, which makes them lightweight and fast. Docker Engine uses UnionFS 
to provide the building blocks for containers. 
– Container format: Container format is the wrapper around NameSpaces, control 
groups, and UnionFS. The default container format is libcontainer. 
Namespace Description
PID Process isolation (PID: Process ID)
NET Managing network interfaces (NET: Networking)
IPC Managing access to IPC resource s (IPC: InterProcess Communication)
MNT Managing file system mount points (MNT: Mount)
UTS Isolating kernel and version identifiers. (UTS: UNIX Timesharing System)