Docker

Docker was presented by Solomon Hykes of dotCloud at PyCon in March 2013. The early engine drove LXC; in 2014 it switched to its own Go library, libcontainer, which Docker donated to the newly founded Open Container Initiative in 2015 where it became runc. Today's Docker Engine is a stack: the docker CLI sends REST calls to the dockerd daemon over a Unix socket (/var/run/docker.sock) or, if configured, TCP; dockerd delegates container lifecycle (and, with the containerd image store enabled, image storage) to containerd over gRPC; containerd starts a shim per container, and the shim invokes runc to set up namespaces, cgroups and the security profile. The open-source parts are developed under the Moby project, while Docker Desktop is a separate commercial product that runs the engine inside a lightweight Linux VM on macOS and Windows.

Images are built from a Dockerfile, a sequence of instructions (FROM, RUN, COPY, ENV, USER, ENTRYPOINT, CMD…) in which filesystem-changing steps produce layers. Since Docker Engine 23.0 (February 2023) the default builder on Linux is BuildKit, which executes a dependency graph in parallel, supports cache mounts, secret mounts (RUN --mount=type=secret) that keep credentials out of layers, multi-platform builds via buildx, and can emit SBOM and provenance attestations. Docker Compose describes multi-container applications on one host in a compose.yaml file; Swarm mode adds basic clustering, although most multi-host production use has moved to Kubernetes.

The main security property of the classic setup is that dockerd runs as root and anyone who can reach its API controls the host: docker run -v /:/host --privileged gives a root shell on the machine, so membership of the docker group is root-equivalent and mounting docker.sock into a container (common in CI runners and monitoring agents) hands that power to the container. An exposed TCP socket without mutual TLS on port 2375 is a long-standing target for cryptomining campaigns. Mitigations include rootless mode (daemon and containers inside a user namespace), userns-remap, authorization plugins, the default seccomp and AppArmor profiles, --cap-drop=ALL with selective --cap-add, --read-only, and never using --privileged in production. The CIS Docker Benchmark collects such settings as auditable checks.

Docker is often used as a synonym for containers, which is misleading. Kubernetes stopped supporting Docker Engine as a runtime when dockershim was removed in 1.24, yet images built with Docker run everywhere because they follow the OCI image format; Podman offers a largely CLI-compatible daemonless alternative. Licensing also matters in organisations: since 2021 Docker Desktop requires a paid subscription for larger commercial users, whereas Docker Engine on Linux remains open source under the Apache 2.0 licence.