Installing Docker on Ubuntu

Udpate the package index and install Docker using the system package manager:

sudo apt update
sudo apt install -y docker.io
sudo systemctl enable docker
sudo systemctl start docker

Verify the installation:

sudo docker --version
sudo docker run --rm hello-world

Launching a Container with Resource Mapping

Run an interactive Ubuntu container, mounting a host directory and exposing ports:

sudo docker run -it \
  -v /home/liyafei/myfile:/mnt/shared:ro \
  -p 9000:9002 \
  ubuntu:14.04 \
  /bin/bash

• The -v flag binds /home/liyafei/myfile on the host to /mnt/shared inside the container (read-only in this example).
• The -p flag forwards port 9000 on the host to port 9002 inside the container.

Saving Container State as a New Image

After modifying the running container (e.g., installing packages or editing files), commit its current filesystem state to a new image:

docker commit 6851e61bbf29 my-ubuntu-base:v1

Export the image to a portable archive:

docker save -o my-ubuntu-base-v1.tar my-ubuntu-base:v1

Loading and Running Saved Images

Load the archived image back into the local Docker daemon:

docker load -i my-ubuntu-base-v1.tar

Start a new container from the loaded image, optionally reusing volume mounts:

docker run -it \
  -v /home/liyafei/myfile:/mnt/shared \
  my-ubuntu-base:v1 \
  /bin/bash

Underlying Architecture Overview

Docker relies on two core Linux kernel features:

• Namespaces: Isolate process trees, network stacks, mount points, UTS (hostname), IPC, and user IDs.
• Cgroups (Control Groups): Enforce resource limits (CPU shares, memory caps, I/O bandwidth) per container.

Images are built as layered filesystems—typically using overlay2—with each layer representing a set of file additions, modifications, or deletions. This enables efficient sharing and versioning.

To inspect the root filesystem of a minimal image like busybox, use:

docker export $(docker create busybox) | tar -C ./busybox-root -xvf -
ls ./busybox-root

This reveals a standard Unix-like hiearrchy (bin/, etc/, usr/, etc.), confirming that an image is fundamentally a structured archive of files and metadata.

Visualizing Container Processes

Use pstree to examine how Docker containers appear in the host’s process hierarchy:

pstree -p | grep -A5 -B5 docker

Each containerized process appears as a child of dockerd, often nested under containerd-shim and runc processses—illustrating the runtime delegation chain.