AMD64 is AMD’s 64-bit extension of Intel’s x86 architecture, and is alsoreferred to as x86_64 (or x86-64).

aufs (advanced multi layered unification filesystem) is a Linux filesystem thatDocker supports as a storage backend. It implements theunion mount for Linux file systems.

A base image has no parent image specified in its Dockerfile. It is createdusing a Dockerfile with the FROM scratch directive.

btrfs (B-tree file system) is a Linux filesystem that Dockersupports as a storage backend. It is a copy-on-writefilesystem.

build is the process of building Docker images using a Dockerfile.The build uses a Dockerfile and a “context”. The context is the set of files in thedirectory in which the image is built.

cgroups is a Linux kernel feature that limits, accounts for, and isolatesthe resource usage (CPU, memory, disk I/O, network, etc.) of a collectionof processes. Docker relies on cgroups to control and isolate resource limits.

Also known as : control groups

A cluster is a group of machines that work together to run workloads and provide high availability.

Compose is a tool for defining andrunning complex applications with Docker. With Compose, you define amulti-container application in a single file, then spin yourapplication up in a single command which does everything that needs tobe done to get it running.

Also known as : docker-compose, fig

Docker uses acopy-on-writetechnique and a union file system for both images andcontainers to optimize resources and speed performance. Multiple copies of anentity share the same instance and each one makes only specific changes to itsunique layer.

Multiple containers can share access to the same image, and makecontainer-specific changes on a writable layer which is deleted whenthe container is removed. This speeds up container start times and performance.

Images are essentially layers of filesystems typically predicated on a baseimage under a writable layer, and built up with layers of differences from thebase image. This minimizes the footprint of the image and enables shareddevelopment.

For more about copy-on-write in the context of Docker, see Understand images,containers, and storagedrivers.

A container is a runtime instance of a docker image.

A Docker container consists of

• A Docker image
• An execution environment
• A standard set of instructions

The concept is borrowed from Shipping Containers, which define a standard to shipgoods globally. Docker defines a standard to ship software.

The term Docker can refer to

• The Docker project as a whole, which is a platform for developers and sysadmins todevelop, ship, and run applications
• The docker daemon process running on the host which manages images and containers(also called Docker Engine)

Docker Desktop for Mac is an easy-to-install, lightweightDocker development environment designed specifically for the Mac. A nativeMac application, Docker Desktop for Mac uses the macOS Hypervisorframework, networking, and filesystem. It’s the best solution if you wantto build, debug, test, package, and ship Dockerized applications on aMac.

Docker Desktop for Windows is aneasy-to-install, lightweight Docker development environment designedspecifically for Windows 10 systems that support Microsoft Hyper-V(Professional, Enterprise and Education). Docker Desktop for Windows uses Hyper-V forvirtualization, and runs as a native Windows app. It works with Windows Server2016, and gives you the ability to set up and run Windows containers as well asthe standard Linux containers, with an option to switch between the two. Dockerfor Windows is the best solution if you want to build, debug, test, package, andship Dockerized applications from Windows machines.

The Docker Hub is a centralized resource for working withDocker and its components. It provides the following services:

• Docker image hosting
• User authentication
• Automated image builds and work-flow tools such as build triggers and web hooks
• Integration with GitHub and Bitbucket

A Dockerfile is a text document that contains all the commands you wouldnormally execute manually in order to build a Docker image. Docker canbuild images automatically by reading the instructions from a Dockerfile.

In a Dockerfile, an ENTRYPOINT is an optional definition for the first partof the command to be run. If you want your Dockerfile to be runnable withoutspecifying additional arguments to the docker run command, you must specifyeither ENTRYPOINT, CMD, or both.

• If ENTRYPOINT is specified, it is set to a single command. Most officialDocker images have an ENTRYPOINT of /bin/sh or /bin/bash. Even if youdo not specify ENTRYPOINT, you may inherit it from the base image that youspecify using the FROM keyword in your Dockerfile. To override theENTRYPOINT at runtime, you can use --entrypoint. The following exampleoverrides the entrypoint to be /bin/ls and sets the CMD to -l /tmp.

• CMD is appended to the ENTRYPOINT. The CMD can be any arbitrary stringthat is valid in terms of the ENTRYPOINT, which allows you to passmultiple commands or flags at once. To override the CMD at runtime, justadd it after the container name or ID. In the following example, the CMDis overridden to be /bin/ls -l /tmp.

In practice, ENTRYPOINT is not often overridden. However, specifying theENTRYPOINT can make your images more flexible and easier to reuse.

A file system is the method an operating system uses to name filesand assign them locations for efficient storage and retrieval.

Examples :

• Linux : ext4, aufs, btrfs, zfs
• Windows : NTFS
• macOS : HFS+

Docker images are the basis of containers. An Image is anordered collection of root filesystem changes and the correspondingexecution parameters for use within a container runtime. An image typicallycontains a union of layered filesystems stacked on top of each other. An imagedoes not have state and it never changes.

In an image, a layer is modification to the image, represented by an instruction in theDockerfile. Layers are applied in sequence to the base image to create the final image.When an image is updated or rebuilt, only layers that change need to be updated, andunchanged layers are cached locally. This is part of why Docker images are so fastand lightweight. The sizes of each layer add up to equal the size of the final image.

libcontainer provides a native Go implementation for creating containers withnamespaces, cgroups, capabilities, and filesystem access controls. It allowsyou to manage the lifecycle of the container performing additional operationsafter the container is created.

libnetwork provides a native Go implementation for creating and managing containernetwork namespaces and other network resources. It manages the networking lifecycleof the container performing additional operations after the container is created.

links provide a legacy interface to connect Docker containers running on thesame host to each other without exposing the hosts’ network ports. Use theDocker networks feature instead.

Machine is a Docker tool whichmakes it really easy to create Docker hosts on your computer, oncloud providers and inside your own data center. It creates servers,installs Docker on them, then configures the Docker client to talk to them.

Also known as : docker-machine

A Linux namespaceis a Linux kernel feature that isolates and virtualizes system resources. Processes which are restricted toa namespace can only interact with resources or processes that are part of the same namespace. Namespacesare an important part of Docker’s isolation model. Namespaces exist for each type ofresource, including net (networking), mnt (storage), pid (processes), uts (hostname control),and user (UID mapping). For more information about namespaces, see Docker run reference and Isolate containers with a user namespace.

A node is a physical or virtualmachine running an instance of the Docker Engine in swarm mode.

Manager nodes perform swarm management and orchestration duties. By defaultmanager nodes are also worker nodes.

Worker nodes execute tasks.

Overlay network driver provides out of the box multi-host network connectivityfor docker containers in a cluster.

OverlayFS is a filesystem service for Linux which implements aunion mount for other file systems.It is supported by the Docker daemon as a storage driver.

An image’s parent image is the image designated in the FROM directivein the image’s Dockerfile. All subsequent commands are based on this parentimage. A Dockerfile with the FROM scratch directive uses no parent image, and createsa base image.

Persistent storage or volume storage provides a way for a user to add apersistent layer to the running container’s file system. This persistent layercould live on the container host or an external device. The lifecycle of thispersistent layer is not connected to the lifecycle of the container, allowinga user to retain state.

A Registry is a hosted service containing repositories of imageswhich responds to the Registry API.

The default registry can be accessed using a browser at Docker Hubor using the docker search command.

A repository is a set of Docker images. A repository can be shared by pushing itto a registry server. The different images in the repository can belabeled using tags.

Here is an example of the shared nginx repositoryand its tags.

SSH (secure shell) is a secure protocol for accessing remote machines and applications.It provides authentication and encrypts data communication over insecure networks suchas the Internet. SSH uses public/private key pairs to authenticate logins.

A service is the definition of howyou want to run your application containers in a swarm. At the most basic levela service defines which container image to run in the swarm and which commandsto run in the container. For orchestration purposes, the service defines the“desired state”, meaning how many containers to run as tasks and constraints fordeploying the containers.

Frequently a service is a microservice within the context of some largerapplication. Examples of services might include an HTTP server, a database, orany other type of executable program that you wish to run in a distributedenvironment.

Swarm mode service discovery is a DNS componentinternal to the swarm that automatically assigns each service on an overlaynetwork in the swarm a VIP and DNS entry. Containers on the network share DNSmappings for the service via gossip so any container on the network can accessthe service via its service name.

You don’t need to expose service-specific ports to make the service available toother services on the same overlay network. The swarm’s internal load balancerautomatically distributes requests to the service VIP among the active tasks.

A swarm is a cluster of one or more Docker Engines running in swarm mode.

Do not confuse Docker Swarm with the swarm mode features in Docker Engine.

Docker Swarm is the name of a standalone native clustering tool for Docker.Docker Swarm pools together several Docker hosts and exposes them as a singlevirtual Docker host. It serves the standard Docker API, so any tool that alreadyworks with Docker can now transparently scale up to multiple hosts.

Also known as : docker-swarm

Swarm mode refers to cluster management and orchestrationfeatures embedded in Docker Engine. When you initialize a new swarm (cluster) orjoin nodes to a swarm, the Docker Engine runs in swarm mode.

A tag is a label applied to a Docker image in a repository.Tags are how various images in a repository are distinguished from each other.

Note : This label is not related to the key=value labels set for docker daemon.

A task is theatomic unit of scheduling within a swarm. A task carries a Docker container andthe commands to run inside the container. Manager nodes assign tasks to workernodes according to the number of replicas set in the service scale.

The diagram below illustrates the relationship of services to tasks andcontainers.

Union file systems implement a unionmount and operate by creatinglayers. Docker uses union file systems in conjunction withcopy-on-write techniques to provide the building blocks forcontainers, making them very lightweight and fast.

For more on Docker and union file systems, see Docker and AUFS inpractice,Docker and Btrfs inpractice,and Docker and OverlayFS inpractice.

Example implementations of union file systems areUnionFS,AUFS, andBtrfs.

A virtual machine is a program that emulates a complete computer and imitates dedicated hardware.It shares physical hardware resources with other users but isolates the operating system. Theend user has the same experience on a Virtual Machine as they would have on dedicated hardware.

Compared to containers, a virtual machine is heavier to run, provides more isolation,gets its own set of resources and does minimal sharing.

Also known as : VM

A volume is a specially-designated directory within one or more containersthat bypasses the Union File System. Volumes are designed to persist data,independent of the container’s life cycle. Docker therefore never automaticallydeletes volumes when you remove a container, nor will it “garbage collect”volumes that are no longer referenced by a container.Also known as: data volume

There are three types of volumes: host, anonymous, and named:

• A host volume lives on the Docker host’s filesystem and can be accessed from within the container.

• A named volume is a volume which Docker manages where on disk the volume is created,but it is given a name.

• An anonymous volume is similar to a named volume, however, it can be difficult, to refer tothe same volume over time when it is an anonymous volumes. Docker handle where the files are stored.

x86_64 (or x86-64) refers to a 64-bit instruction set invented by AMD as anextension of Intel’s x86 architecture. AMD calls its x86_64 architecture,AMD64, and Intel calls its implementation, Intel 64.