TECH **Docker Architecture: Daemon, Client, Registry – Zero-Fluff Study Guide**

Docker Architecture: Daemon, Client, Registry – Zero-Fluff Study Guide

For engineers who need to deploy, debug, and scale containers in production.

1. What This Is & Why It Matters

Docker’s architecture is the backbone of how containers run in development, CI/CD, and production. If you don’t understand the daemon, client, and registry, you’ll: - Waste hours debugging "Why won’t my container start?" (Hint: The daemon isn’t running.) - Accidentally expose sensitive images to the public (Registry misconfigurations are a top cause of breaches.) - Struggle to scale deployments because you don’t know how images are pulled and cached.

Real-world scenario:
You’re onboarding to a new team. The CI/CD pipeline fails with Error: Cannot connect to the Docker daemon. The logs show dial unix /var/run/docker.sock: connect: permission denied. Your task: Fix it now so the team can deploy. Without knowing how the daemon, client, and registry interact, you’re stuck guessing.

This guide gives you the exact commands, configs, and troubleshooting steps to: ✅ Deploy containers reliably in production.
✅ Debug permission errors, image pulls, and registry issues.
✅ Pass hands-on certs (CKA, Docker Certified Associate) with confidence.

2. Core Concepts & Components

? Docker Daemon (dockerd)

• Definition: The background service that manages Docker objects (containers, images, networks, volumes). Runs on the host machine.
• Production insight:
• If the daemon crashes, all containers on that host stop. Use --restart=always for critical containers.
• The daemon listens on a Unix socket (/var/run/docker.sock) by default. Never expose this socket to the internet—it’s a root-level access point.

? Docker Client (docker CLI)

• Definition: The command-line tool you use to interact with the daemon (e.g., docker run, docker build).
• Production insight:
• The client can connect to a remote daemon (e.g., Docker Desktop, a cloud VM). Use DOCKER_HOST to switch contexts.
• If you get Cannot connect to the Docker daemon, check:
  • Is the daemon running? (sudo systemctl status docker)
  • Do you have permissions? (Are you in the docker group?)

? Docker Registry

• Definition: A server that stores and distributes Docker images (e.g., Docker Hub, AWS ECR, private registries).
• Production insight:
• Private registries are mandatory for production. Public registries (like Docker Hub) have rate limits and security risks.
• Always use image tags (e.g., myapp:v1.2.3)—latest is a recipe for "works on my machine" disasters.

? Docker Image

• Definition: A read-only template with instructions for creating a container (e.g., nginx:alpine).
• Production insight:
• Images are layered. Each RUN command in a Dockerfile adds a layer. Optimize layers to reduce image size (and pull times).
• Use multi-stage builds to strip out build tools (e.g., compilers) from the final image.

? Docker Container

• Definition: A runnable instance of an image.
• Production insight:
• Containers are ephemeral. Never store data in them—use volumes or bind mounts.
• Use docker ps -a to find "zombie" containers eating up disk space.

? Docker Context

• Definition: A configuration that defines which daemon the client talks to (local, remote, or Kubernetes).
• Production insight:
• Switch contexts with docker context use <name> to manage multiple environments (e.g., dev vs. prod).
• Critical for hybrid setups (e.g., local Docker + remote Kubernetes).

3. Step-by-Step Hands-On: Deploy a Private Registry & Push/Pull Images

Prerequisites

• A Linux VM or local Docker installation (Docker Desktop works).
• sudo access (for daemon config).
• A domain name (optional, for HTTPS).

Step 1: Run a Local Docker Registry

# Start a registry container (insecure, for testing only)
docker run -d -p 5000:5000 --name registry registry:2

Verify:

curl http://localhost:5000/v2/_catalog
# Expected output: {"repositories":[]}

Step 2: Build and Tag an Image for the Registry

# Build a simple Nginx image
docker build -t my-nginx - <<EOF
FROM nginx:alpine
RUN echo "Hello from private registry!" > /usr/share/nginx/html/index.html
EOF

# Tag the image for your registry (format: <registry-url>/<image>:<tag>)
docker tag my-nginx localhost:5000/my-nginx:v1

Step 3: Push the Image to the Registry

docker push localhost:5000/my-nginx:v1

Troubleshooting:
- If you get http: server gave HTTP response to HTTPS client, add the registry to Docker’s insecure registries: bash # Edit /etc/docker/daemon.json (create if it doesn’t exist) echo '{"insecure-registries": ["localhost:5000"]}' | sudo tee /etc/docker/daemon.json sudo systemctl restart docker

Step 4: Pull the Image from the Registry

# Remove the local image first
docker rmi my-nginx localhost:5000/my-nginx:v1

# Pull from the registry
docker pull localhost:5000/my-nginx:v1

# Run it
docker run -d -p 8080:80 --name my-nginx localhost:5000/my-nginx:v1

Verify:

curl http://localhost:8080
# Expected output: "Hello from private registry!"

Step 5: Secure the Registry (Production-Ready)

1. Enable HTTPS (use Let’s Encrypt or a self-signed cert):
   bash
openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt
2. Run the registry with TLS:
   bash
docker run -d -p 5000:5000 --name registry \
-v $(pwd)/domain.crt:/certs/domain.crt \
-v $(pwd)/domain.key:/certs/domain.key \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
registry:2
3. Authenticate with the registry:
   ```bash
   # Create a password file
   mkdir auth
   docker run --entrypoint htpasswd httpd:2 -Bbn testuser testpassword > auth/htpasswd

# Run the registry with auth
docker run -d -p 5000:5000 --name registry \
-v $(pwd)/auth:/auth \
-e "REGISTRY_AUTH=htpasswd" \
-e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
-e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" \
registry:2
4. Log in and push:bash
docker login localhost:5000
# Username: testuser, Password: testpassword
docker push localhost:5000/my-nginx:v1
```

4. ? Production-Ready Best Practices

Security

• Never run the daemon as root. Use rootless Docker (dockerd-rootless-setuptool.sh).
• Scan images for vulnerabilities (use docker scan or Trivy).
• Sign images with Docker Content Trust to prevent tampering: bash export DOCKER_CONTENT_TRUST=1 docker push my-registry/my-image:signed
• Use private registries (AWS ECR, GCR, or self-hosted) for production. Docker Hub is for public images only.

Cost Optimization

• Minimize image layers (combine RUN commands in Dockerfile).
• Use multi-stage builds to reduce image size: ```dockerfile FROM golang:1.21 as builder WORKDIR /app COPY . .
  RUN go build -o myapp

FROM alpine:latest COPY --from=builder /app/myapp .
CMD ["./myapp"] - Clean up unused images/volumes regularly:bash docker system prune -a --volumes ```

Reliability & Maintainability

• Tag images with semantic versioning (v1.2.3), not latest.
• Use .dockerignore to exclude unnecessary files (e.g., .git, node_modules).
• Pin base images (e.g., FROM alpine:3.18 instead of FROM alpine).

Observability

• Monitor the daemon (docker stats, docker events).
• Log container output (use docker logs or forward to ELK/Grafana).
• Set resource limits to prevent noisy neighbors: bash docker run -d --memory="512m" --cpus="1" my-app

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus

Typical Question Patterns

1. Daemon vs. Client:
2. "Which component manages containers on the host?" → Daemon.

3. "Which command connects to a remote daemon?" → docker -H tcp://<ip>:2375.

4. Registry Security:

5. "How do you prevent unauthorized access to a private registry?" → Enable auth (htpasswd) and HTTPS.

6. Image Tags:

7. "What’s the risk of using latest in production?" → Unpredictable updates break deployments.

8. Debugging:

9. "A container fails to start. What’s the first command to debug?" → docker logs <container>.

Key ⚠️ Trap Distinctions

• Daemon vs. Client:
• The client is the CLI (docker command). The daemon is the background service (dockerd).
• If docker ps works but docker run fails, the daemon is likely the issue.
• Registry vs. Repository:
• A registry is the server (e.g., Docker Hub). A repository is a collection of images (e.g., nginx).

Scenario-Based Question

"You need to deploy a private registry for a team of 10 developers. What’s the most secure way to set it up?" Answer:
1. Run the registry with TLS (REGISTRY_HTTP_TLS_CERTIFICATE).
2. Enable auth (REGISTRY_AUTH=htpasswd).
3. Use a reverse proxy (e.g., Nginx) for additional security.

7. ? Hands-On Challenge

Challenge:
You’re debugging a CI/CD pipeline that fails with:

Error response from daemon: Get "https://registry-1.docker.io/v2/": dial tcp: lookup registry-1.docker.io: no such host

Task: Fix the issue so the pipeline can pull images from Docker Hub.

Solution:

# Check DNS resolution
nslookup registry-1.docker.io

# If DNS fails, use Google's DNS (8.8.8.8) or Cloudflare (1.1.1.1)
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

# Restart Docker
sudo systemctl restart docker

Why it works:
The error indicates a DNS failure. Switching to a public DNS resolver (like Google’s) fixes the issue.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. Docker Daemon Documentation – Official guide to daemon config.
2. Docker Registry Docs – Secure registry setup.
3. Rootless Docker – Run the daemon without root.
4. Docker Certified Associate Study Guide – Hands-on prep for the DCA exam.