Docker is an open platform for developing, shipping, and running applications. It provides the ability to package and run an application in a loosely isolated environment called a container. Unlike VMs, which rely on full OS virtualization, containerization offered a lightweight alternative, a way to package applications and their dependencies into isolated environments.You can share containers while you work, and be sure that everyone you share with gets the same container that works in the same way.
In the VM model, each application runs on its own guest operating system atop a hypervisor, leading to significant overhead due to each VM including a full OS. This consumes considerable resources and results in inefficient deployments. In contrast, the containerization model uses a container engine on the host OS, packaging each application and its dependencies into lightweight containers that share the host OS kernel but remain isolated. This results in efficient resource usage, faster startup times, and improved scalability, making containerization superior for modern software development.
The kernel is a computer program that forms the core of a computer's operating system, having complete control over all system aspects. It serves as an intermediary between the system's hardware and the remaining software, abstracting the physical differences among various hardware setups. This provides a standardized interface for other software to interact with. The kernel enhances security and stability as it requires software to pass through it to access the hardware. Additionally, it manages memory access. Kernels can be categorized into two types: monolithic and microkernels.
In 1979, the chroot system call was introduced. This allowed administrators to change the root directory for a process and its children to a new location, isolating the process within a specific subtree of the filesystem.
In the early 2000s, Linux developers started working on a series of patches to introduce the concept of Namespaces, which are a powerful feature that provides isolation at various levels (mount, PID, network, user, etc.). This allows processes within it to have a separate instance of that particular resource, effectively creating isolated environments.
At the same time, the control groups (Cgroups) were introduced in the Linux kernel. These provide a mechanism for aggregating and partitioning sets of tasks (processes) and managing their resource usage. Administrators could now limit the amount of CPU, memory, disk I/O, and network bandwidth each group of processes can use. This ensured that no single process could monopolize system resources, providing better control and stability.
The combination of namespaces and Cgroups laid the foundation for modern containerization. By using namespaces, the system could isolate various aspects of the environment, making each container appear as if it were running on its isolated instance of the operating system. Meanwhile, Cgroups ensured that containers could be limited in their resource consumption, ensuring they ran efficiently alongside other containers.
In 2013, Docker was introduced, providing an easy-to-use platform that abstracted the complexities of namespaces and Cgroups.
A Dockerfile is a text file that contains instructions for creating a Docker image, defining the environment, base image, dependencies, files to copy, and commands to run. This provides a reproducible and automated way to build Docker images. It’s like a blueprint for creating a Docker image (similar to a Makefile).
The next step is to build the Docker image using the docker build command. A Docker image has everything needed to run a containerized application, including code, config files, environment variables, libraries, and runtimes.
After building the Docker image, you can run a container using the docker run command. This involves creating a new container, isolating its resources, managing resource allocation, and starting the container to run the specified command from the Dockerfile.