Docker Engine Basics

This page is a hands-on intro to running Docker Engine: checking the daemon, running your first containers, and understanding the daemon-versus-CLI split plus rootless mode.

Prerequisites

• Docker Engine 29.6.1 on Linux (BuildKit is the default build backend).
• A user in the docker group, or use sudo, or run rootless mode.
• systemd to manage the daemon on most distributions.

Quick install on Debian/Ubuntu via the official convenience script:

curl -fsSL https://get.docker.com | sh
sudo systemctl enable --now docker
docker version

Basic Examples

1. Confirm the daemon and CLI are talking

Verify both halves of the client-server system report versions.

docker version

• The Client block is the docker CLI you typed.
• The Server block is dockerd. If it is missing, the daemon is not running or your socket is wrong.
• docker info adds runtime details: storage driver, cgroup version, and the containerd/runc versions.
• No Server block usually means systemctl start docker is needed.

2. Run your first container

Start a container and see it print output, then exit.

docker run --rm hello-world

• docker run pulls the image if absent, creates a container, and starts it.
• --rm deletes the container when it exits, keeping your system clean.
• The CLI sent this to the daemon over /var/run/docker.sock.
• The image came from Docker Hub because no registry prefix was given.

3. Run a long-lived service in the background

Detach a web server and map a port to the host.

docker run -d --name web -p 8080:80 nginx:1.27

• -d runs detached so your terminal returns immediately.
• --name web gives a stable handle instead of a random name.
• -p 8080:80 publishes container port 80 on host port 8080.
• Always pin a tag (nginx:1.27) rather than the moving latest.

4. List and inspect running containers

See what is running and where.

docker ps

• docker ps shows only running containers; add -a to include stopped ones.
• The STATUS column reveals restarts and health-check state.
• docker ps --format '{{.Names}} {{.Ports}}' trims output to what you need.
• Each row is one container process supervised by a shim.

5. Read logs from a container

Stream stdout and stderr the daemon captured.

docker logs -f web

• -f follows the log stream like tail -f.
• The daemon stores these via its logging driver (json-file by default).
• Add --since 10m to bound noisy output.
• Apps should log to stdout/stderr so Docker can collect it.

6. Get a shell inside a container

Exec into a running container for debugging.

docker exec -it web sh

• exec starts a new process inside the container's namespaces.
• -it allocates an interactive TTY.
• This does not restart the container; it joins the live one.
• Prefer sh for minimal images that lack bash.

7. Stop and remove containers

Clean up cleanly rather than killing processes.

docker stop web && docker rm web

• stop sends SIGTERM, waits (default 10s), then SIGKILL.
• rm deletes the stopped container and its writable layer.
• Named volumes survive unless you add -v.
• docker rm -f web force-stops and removes in one step.

Intermediate Examples

8. Understand daemon vs CLI with a remote host

The CLI is a client; point it at another engine without installing anything new.

export DOCKER_HOST=ssh://ops@buildhost
docker ps

• DOCKER_HOST redirects every CLI call to a remote daemon.
• Over SSH, no TLS certificates or open ports are required.
• The containers listed live on buildhost, not your laptop.
• Unset the variable or use contexts to switch back.

9. Run rootless Docker

Run the daemon and containers without real root to shrink the attack surface.

dockerd-rootless-setuptool.sh install
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/docker.sock
docker run --rm hello-world

• Rootless runs dockerd inside a user namespace, so root in the container maps to your unprivileged UID.
• Privileged ports below 1024 need extra configuration to publish.
• Some storage and networking features differ from rootful mode.
• It is a strong default for shared build hosts and developer machines.

10. Limit container resources

Set CPU and memory bounds so one container cannot starve the host.

docker run -d --name api \
  --memory=512m --cpus=1.5 \
  --restart=on-failure:3 \
  myorg/api:1.4.0

• --memory caps RAM; the container is OOM-killed if it exceeds it.
• --cpus=1.5 limits it to one and a half cores via cgroups.
• --restart=on-failure:3 retries up to three times on non-zero exit.
• These map to the same cgroup controls Kubernetes uses for requests and limits.

Stack versions: This page was written for Kubernetes 1.36.2, Docker Engine 29.6.1 (BuildKit default), containerd (CRI runtime on nodes), Helm 3, Compose v2, Argo CD (latest - verify at build), and Gateway API (GA - verify controller support at build).