What is Docker?
IT software "Docker" is containerization technology that enables you to create and use Linux® containers.
The open-source Docker community works to improve this technology and makes it freely available so that all users can benefit from it.
Docker Inc. got its start with the Docker community's product and is chiefly responsible for improving the security of the community edition and for sharing technology advancements with the wider technical community. In addition, it specifically refines and hardens these technology products for its enterprise customers.
How does Docker work?
Docker technology uses the Linux kernel and kernel features (such as cgroups and namespaces) to segregate processes so that they can run independently of one another. This independence is precisely the purpose of using containers: it lets you run multiple processes and multiple applications separately, making fuller use of your infrastructure while keeping each individual system secure.
Container tools (including Docker) provide an image-based deployment model. This makes it easy to share an application or set of services, together with their dependencies, across multiple environments. Docker can also deploy applications automatically inside this containerized environment (or combine multiple processes in order to build a single application).
Moreover, because these tools are built on top of Linux containers, Docker is both easy to use and truly distinctive, offering users unprecedented access to applications, rapid deployment, and version control and distribution capabilities.
So, what are Linux containers?
Linux containers are a form of operating-system-level virtualization that allows multiple isolated user-space instances to run on the same kernel. Docker is built precisely on this underlying technology, providing developers with a complete toolchain for packaging, distributing, and running applications.
Red Hat resources · Further reading
What is the difference between Docker and Linux containers?
This video cannot be played due to your privacy settings
To change your settings, select the "Cookie preferences" link in the footer and choose "Advertising cookies".
Although the terms are sometimes used interchangeably, Docker is not the same as traditional Linux containers. Docker technology was initially built on top of the LXC technology — what most people associate with "traditional" Linux containers — but it has since moved away from that dependency. LXC is useful as a lightweight virtualization technology, but it does not offer an ideal experience for developers and users. Beyond running containers, Docker technology offers several other capabilities, including streamlining the processes used to build containers, transfer images, and control image versions.
Docker vs. Linux containers at a glance
Traditional Linux Containers
- Use an init system to manage multiple processes
- Run all applications as one monolithic whole
- Processes share their runtime environment with one another
Docker Containers
- Let each application run its own processes independently
- Provide the tools that help make this possible
- Operate at a fine-grained level, keeping processes isolated from one another
What are the advantages of Docker containers?
Modularity
The Docker approach to containerization focuses on the ability to take down only one part of an application to update or repair it, without having to take down the entire application.
Layers and Image Version Control
Every Docker image file is made up of multiple layers. Whenever an image changes, a new layer is created, and these layers can be reused to build new containers, which speeds up the build process.
Rollback
Every image has multiple layers. Not happy with the current iteration? Simply roll it back to the previous version. This supports agile development methods and helps enable continuous integration and deployment (CI/CD).
Rapid Deployment
Docker-based containers can cut deployment down to mere seconds. There is no need to reboot the operating system when adding or moving containers, which dramatically shortens deployment time.
What are the limitations of using Docker?
Docker on its own can manage individual containers. But as you start using more and more containers and containerized applications, and break them down into hundreds of pieces, management and orchestration can become difficult. Eventually, you need to take a step back and group containers together so that services such as networking, security, and telemetry can be delivered across all of them. That is where Kubernetes comes in.
Learn more about Kubernetes container orchestration →
With Docker, you get UNIX-like capabilities that differ from traditional Linux containers, including the ability to use processes such as cron or syslog inside your containers alongside your application. Of course, there are some limitations — for example, after a child process is terminated, grandchild processes may need to be cleaned up, something traditional Linux containers handle natively. However, these concerns can be eliminated by modifying configuration files and setting capabilities at the start; they are minor issues that do not outweigh the benefits.
Are Docker containers really secure?
On top of that, there are other non-namespaced Linux subsystems and devices, including SELinux, cgroups, and /dev/sd* devices. This means that if an attacker gains control of these subsystems, the host is compromised as well. To stay lightweight, containers share the kernel with the host, which plants the seeds for potential security vulnerabilities. In this respect they differ from virtual machines, which remain much more strictly isolated from the host system.
The Docker daemon can also be a security concern. To use and run Docker containers, you will most likely need to use the Docker daemon, which provides a continuous runtime environment for containers. The Docker daemon requires root privileges, so we need to pay special attention to who can access that process and where it resides. For example, a local daemon has a far smaller attack surface than a daemon used in a public area (such as a web server).