title: Understanding the technical (Docker) container architecture
body: <p>I am new to containers and would like to get a good knowledge about how container technology (Docker) is made up from 'scratch'. I have to write a paper and hope that I have every important thing correctly understood so far.</p>
  <p>The following diagram is made by me and shows my current understanding of containers.</p>
  <p><a href="https://i.stack.imgur.com/cjF6J.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cjF6J.jpg" alt="enter image description here" /></a></p>
  <p>Obviously we need an OS with a Kernel that allows us to use the hardware. For Docker this is Linux. Docker for Windows uses a VM with Linux for that.</p>
  <p>On top of our Linux OS we then run our Docker Engine. Our Docker Engine is in charge of starting, building, configuring ... our images and containers. But most importantly the Docker Engine handles everything that has to do with isolating of containers, for example it maintains how namespaces or cgroups are used so that every container has it's own full filesystem.</p>
  <p>Then we have our actual containers. Containers themselvesneed almost every time a kind of OS itself. This is mostly just a very compact one like Alpine or Busybox. They collect a small number of standard functions such as 'file', 'tar', 'grep' that most software definitely need. This compact OS is now using the Kernel from our full Linux OS. <strong>They don't have their own Kernel.</strong></p>
  <p>On top of the compact OS we then place our actual piece of software such as Node.js or a NGINX Server. This software is only using the compact OS which in return uses the Kernel from our full Linux OS. And all data or modifications that is generated or done in runtime are made on the writeable layer of our container.</p>
  <hr />
  <p>And if I understood correctly, our container or everything that runs in our container is not using or interacting with our full Linux OS but just with it's Kernel?
  I also don't quite understand how the writeable layer in a container works. Like how does my software for example know that a modified file from a read-only layer is now present in the writeable layer and should use this?</p>
  <p>I would really appreciate some corrections or suggestions on what I have missed out so far. Thank you</p>