Docker Tutorial — Docker Daemon & containerd
The Docker stack has three layers: dockerd (the daemon), containerd (container lifecycle manager), and runc (the low-level runtime). Understanding this stack helps you debug issues and understand what’s happening when you run a container.
The Three Layers
dockerd (Docker Daemon)
The top-level service that:
- Listens for API requests from the Docker CLI
- Manages images (pull, build, push)
- Manages volumes and networks
- Delegates container operations to containerd
containerd
A CNCF graduated project that:
- Manages the complete container lifecycle (create, start, stop, delete)
- Manages image pulls and storage
- Works independently of Docker (Kubernetes uses containerd directly)
runc
The OCI reference runtime that:
- Actually creates the container process
- Sets up namespaces, cgroups, and security features
- Exits after the container is running (containerd takes over monitoring)
The Flow: docker run nginx
1. You type: docker run -d nginx
2. CLI sends: POST /containers/create → Docker Daemon
3. Daemon: Pulls image (if needed) → tells containerd to create container
4. containerd: Prepares bundle → calls runc
5. runc: Creates namespaces + cgroups → starts the process → exits
6. containerd: Monitors the running container
7. You see: Container ID printed to terminal
Quick Reference
dockerd → API server, image/volume/network management
containerd → container lifecycle management (CNCF project)
runc → creates containers using kernel features (OCI runtime)
Flow: CLI → dockerd → containerd → runc → container process
