Docker is an open-source platform that automates the deployment of applications inside lightweight, portable containers. A Docker container is a runnable instance of a Docker image: an isolated process that shares the host operating system kernel but has its own filesystem, networking, and process space. Containers are ephemeral by default, meaning any data written inside them is lost when they are removed unless it is stored elsewhere. This model is fundamentally different from virtual machines. Containers share the host kernel and start in milliseconds, while VMs include a full guest operating system, take gigabytes of disk space, and boot in seconds or minutes. The trade-off is that containers provide less hardware-level isolation than VMs but offer higher density and faster startup, which is why they have become the standard unit of deployment in modern cloud environments.
The Docker Engine itself is built from three components: the dockerd daemon, which does the actual work of building images, running containers, and managing networks and volumes; a REST API that the daemon exposes; and the docker CLI client, which sends commands to the daemon over that API. The daemon and CLI typically communicate through a Unix socket at /var/run/docker.sock, but they can also run on separate machines. Underneath the daemon sits containerd, an industry-standard core container runtime that handles image transfer and storage, container execution, network attachment, and storage. Docker Engine uses containerd internally, and Kubernetes can use it directly via its CRI plugin.
The isolation that containers rely on comes from two Linux kernel features: namespaces and cgroups. Namespaces give each container its own view of system resources such as PIDs, network interfaces, mount points, hostnames, inter-process communication, and user IDs, so processes in one container cannot see resources in another by default. Cgroups limit and account for the resources a container can consume, including CPU, memory, disk I/O, and network bandwidth, preventing a single container from exhausting the host. These primitives are what allow Docker to package an application with all its dependencies and guarantee consistent behavior across environments.