Docker Engine Basics

This page is a hands-on intro to running Docker Engine: checking the daemon, running your first containers, and understanding the daemon-versus-CLI split plus rootless mode.

Prerequisites

Docker Engine 29.6.1 on Linux (BuildKit is the default build backend).
A user in the docker group, or use sudo, or run rootless mode.
systemd to manage the daemon on most distributions.

Quick install on Debian/Ubuntu via the official convenience script:

curl -fsSL https://get.docker.com | sh
sudo systemctl enable --now docker
docker version

Basic Examples

1. Confirm the daemon and CLI are talking

Verify both halves of the client-server system report versions.

docker version

The Client block is the docker CLI you typed.
The Server block is dockerd. If it is missing, the daemon is not running or your socket is wrong.
docker info adds runtime details: storage driver, cgroup version, and the containerd/runc versions.
No Server block usually means systemctl start docker is needed.

2. Run your first container

Start a container and see it print output, then exit.

docker run --rm hello-world

docker run pulls the image if absent, creates a container, and starts it.
--rm deletes the container when it exits, keeping your system clean.
The CLI sent this to the daemon over /var/run/docker.sock.
The image came from Docker Hub because no registry prefix was given.

3. Run a long-lived service in the background

Detach a web server and map a port to the host.

docker run -d --name web -p 8080:80 nginx:1.27

-d runs detached so your terminal returns immediately.
--name web gives a stable handle instead of a random name.
-p 8080:80 publishes container port 80 on host port 8080.
Always pin a tag (nginx:1.27) rather than the moving latest.

4. List and inspect running containers

See what is running and where.

docker ps

docker ps shows only running containers; add -a to include stopped ones.
The STATUS column reveals restarts and health-check state.
docker ps --format '{{.Names}} {{.Ports}}' trims output to what you need.
Each row is one container process supervised by a shim.

5. Read logs from a container

Stream stdout and stderr the daemon captured.

docker logs -f web

-f follows the log stream like tail -f.
The daemon stores these via its logging driver (json-file by default).
Add --since 10m to bound noisy output.
Apps should log to stdout/stderr so Docker can collect it.

6. Get a shell inside a container

Exec into a running container for debugging.

docker exec -it web sh

exec starts a new process inside the container's namespaces.
-it allocates an interactive TTY.
This does not restart the container; it joins the live one.
Prefer sh for minimal images that lack bash.

7. Stop and remove containers

Clean up cleanly rather than killing processes.

docker stop web && docker rm web

stop sends SIGTERM, waits (default 10s), then SIGKILL.
rm deletes the stopped container and its writable layer.
Named volumes survive unless you add -v.
docker rm -f web force-stops and removes in one step.

Intermediate Examples

8. Understand daemon vs CLI with a remote host

The CLI is a client; point it at another engine without installing anything new.

export DOCKER_HOST=ssh://ops@buildhost
docker ps

DOCKER_HOST redirects every CLI call to a remote daemon.
Over SSH, no TLS certificates or open ports are required.
The containers listed live on buildhost, not your laptop.
Unset the variable or use contexts to switch back.

9. Run rootless Docker

Run the daemon and containers without real root to shrink the attack surface.

dockerd-rootless-setuptool.sh install
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
docker run --rm hello-world

Rootless runs dockerd inside a user namespace, so root in the container maps to your unprivileged UID.
Privileged ports below 1024 need extra configuration to publish.
Some storage and networking features differ from rootful mode.
It is a strong default for shared build hosts and developer machines.

10. Limit container resources

Set CPU and memory bounds so one container cannot starve the host.

docker run -d --name api \
  --memory=512m --cpus=1.5 \
  --restart=on-failure:3 \
  myorg/api:1.4.0

--memory caps RAM; the container is OOM-killed if it exceeds it.
--cpus=1.5 limits it to one and a half cores via cgroups.
--restart=on-failure:3 retries up to three times on non-zero exit.
These map to the same cgroup controls Kubernetes uses for requests and limits.

Docker Docs - Official Docker documentation (Engine, Desktop, Compose, Build, Hub).
Docker Get Started - Official Docker beginner path.
containerd Documentation - Official docs for the industry-standard container runtime.
Docker Deep Dive - Nigel Poulton.
Learn Docker in a Month of Lunches, 2nd Edition - Elton Stoneman.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).

Prerequisites

Docker Engine 29.6.1 on Linux (BuildKit is the default build backend).
A user in the docker group, or use sudo, or run rootless mode.
systemd to manage the daemon on most distributions.

Quick install on Debian/Ubuntu via the official convenience script:

curl -fsSL https://get.docker.com | sh
sudo systemctl enable --now docker
docker version

Basic Examples

1. Confirm the daemon and CLI are talking

Verify both halves of the client-server system report versions.

docker version

The Client block is the docker CLI you typed.
The Server block is dockerd. If it is missing, the daemon is not running or your socket is wrong.
docker info adds runtime details: storage driver, cgroup version, and the containerd/runc versions.
No Server block usually means systemctl start docker is needed.

2. Run your first container

Start a container and see it print output, then exit.

docker run --rm hello-world

docker run pulls the image if absent, creates a container, and starts it.
--rm deletes the container when it exits, keeping your system clean.
The CLI sent this to the daemon over /var/run/docker.sock.
The image came from Docker Hub because no registry prefix was given.

3. Run a long-lived service in the background

Detach a web server and map a port to the host.

docker run -d --name web -p 8080:80 nginx:1.27

-d runs detached so your terminal returns immediately.
--name web gives a stable handle instead of a random name.
-p 8080:80 publishes container port 80 on host port 8080.
Always pin a tag (nginx:1.27) rather than the moving latest.

4. List and inspect running containers

See what is running and where.

docker ps

docker ps shows only running containers; add -a to include stopped ones.
The STATUS column reveals restarts and health-check state.
docker ps --format '{{.Names}} {{.Ports}}' trims output to what you need.
Each row is one container process supervised by a shim.

5. Read logs from a container

Stream stdout and stderr the daemon captured.

docker logs -f web

-f follows the log stream like tail -f.
The daemon stores these via its logging driver (json-file by default).
Add --since 10m to bound noisy output.
Apps should log to stdout/stderr so Docker can collect it.

6. Get a shell inside a container

Exec into a running container for debugging.

docker exec -it web sh

exec starts a new process inside the container's namespaces.
-it allocates an interactive TTY.
This does not restart the container; it joins the live one.
Prefer sh for minimal images that lack bash.

7. Stop and remove containers

Clean up cleanly rather than killing processes.

docker stop web && docker rm web

stop sends SIGTERM, waits (default 10s), then SIGKILL.
rm deletes the stopped container and its writable layer.
Named volumes survive unless you add -v.
docker rm -f web force-stops and removes in one step.

Intermediate Examples

8. Understand daemon vs CLI with a remote host

The CLI is a client; point it at another engine without installing anything new.

export DOCKER_HOST=ssh://ops@buildhost
docker ps

DOCKER_HOST redirects every CLI call to a remote daemon.
Over SSH, no TLS certificates or open ports are required.
The containers listed live on buildhost, not your laptop.
Unset the variable or use contexts to switch back.

9. Run rootless Docker

Run the daemon and containers without real root to shrink the attack surface.

dockerd-rootless-setuptool.sh install
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
docker run --rm hello-world

Rootless runs dockerd inside a user namespace, so root in the container maps to your unprivileged UID.
Privileged ports below 1024 need extra configuration to publish.
Some storage and networking features differ from rootful mode.
It is a strong default for shared build hosts and developer machines.

10. Limit container resources

Set CPU and memory bounds so one container cannot starve the host.

docker run -d --name api \
  --memory=512m --cpus=1.5 \
  --restart=on-failure:3 \
  myorg/api:1.4.0

--memory caps RAM; the container is OOM-killed if it exceeds it.
--cpus=1.5 limits it to one and a half cores via cgroups.
--restart=on-failure:3 retries up to three times on non-zero exit.
These map to the same cgroup controls Kubernetes uses for requests and limits.

Docker Docs - Official Docker documentation (Engine, Desktop, Compose, Build, Hub).
Docker Get Started - Official Docker beginner path.
containerd Documentation - Official docs for the industry-standard container runtime.
Docker Deep Dive - Nigel Poulton.
Learn Docker in a Month of Lunches, 2nd Edition - Elton Stoneman.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).

Docker Engine Basics

Search Documentation

Docker Engine Basics