When I start a Docker container, what is really happening on the computer? Is the container itself running as a separate program, or is it contained inside the Docker engine as part of that engine's process?
2 Answers
A container is essentially a group of regular processes running on the host operating system, with isolation features applied to them. Docker does not emulate a complete computer by default. The Docker engine runs in the background and asks a container runtime to create and manage those isolated processes. The application inside the container still uses the host kernel, while namespaces provide separation and control groups limit resources such as CPU and memory.
On Linux, the Docker daemon usually runs as a background service. When you launch a container, it prepares the filesystem, networking, environment variables, and isolation settings, then starts the container's main process. If that process exits, the container normally stops too. On macOS and Windows, Docker commonly runs a lightweight Linux virtual machine first, because Linux containers need a Linux kernel; the containers then run inside that VM rather than directly on the native operating system.
So the container is not literally a program nested inside the Docker engine; it is closer to an isolated process or group of processes that the engine starts and manages.