VocalHyre
Sign up

Docker · Containers in practice

Explain the Docker architecture and its main components.

MediumarchitecturedaemoncontainerdUpdated Oct 2026
Quiz this track

Short answer

The Docker client talks over a socket to the daemon, which uses containerd and runc to pull images and start containers. Registries store and distribute images.

The client is the CLI or an API caller. It sends commands to the Docker daemon, which owns images, containers, networks and volumes on the host. The daemon delegates container lifecycle work to containerd, and containerd invokes runc to create the actual container process using namespaces and cgroups.

  • docker CLI: parses commands and calls the daemon API
  • dockerd: image store, build, networking and volume management
  • containerd: container lifecycle, image pull and snapshot management
  • runc: low-level OCI runtime that starts and stops the process
  • Registry: stores image layers and manifests, such as Docker Hub or ECR
sh
docker version
docker info
ls -l /var/run/docker.sock
The client and server versions can differ. Access to the socket is effectively root access on the host.

Where the pieces run

The client can be remote, for example over SSH or a TLS-protected TCP endpoint. The daemon can also run inside a VM, which is how Docker Desktop works on macOS and Windows because those hosts do not provide a native Linux kernel.

Mounting /var/run/docker.sock into a container gives it control of the daemon, which is equivalent to root on the host. Do not do this casually in production or CI.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1What is the role of containerd compared with dockerd?
  2. 2Why does Docker Desktop run a Linux VM on macOS?
  3. 3What are the security implications of exposing the Docker socket?
  4. 4How would you debug a daemon that will not start?

Say it in the interview

The CLI is a client that sends API calls to dockerd over a socket. dockerd manages images, networks and volumes, then hands lifecycle work to containerd, which uses runc to start the process with namespaces and cgroups. Images come from a registry. I also keep in mind that socket access is root-equivalent, so exposing it to a container or CI job is a real security decision.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

EasyWhat is Docker and what problem does it solve?EasyWhat is the difference between an image and a container?HardHow do you harden a container at runtime?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Docker mock interview and get scored feedback on depth, clarity and confidence.

Start a free Docker interviewBrowse all questions