What is Docker?
Updated: 3 days ago
Docker is an open source platform for building, packaging, distributing and running applications in containers. Docker provides the tools around the container lifecycle: a client, Docker Engine, image building, registries, networking, storage and multi-container workflows. The important distinction is that Docker is not the same thing as a container. A container is the isolated running process; Docker is one widely used platform for creating and managing containers.
For broadband users, developers and homelab operators, Docker matters because applications can be moved between machines with their dependencies packaged consistently. Broadband speed affects how quickly container images can be pulled from or pushed to remote registries, while local CPU, storage, memory and networking still determine how quickly the containers themselves run.
What does Docker actually do?
Docker separates an application from much of the configuration of the machine underneath it. A container image packages the files, binaries, libraries and configuration required by the application. Docker Engine can then create a container from that image and provide isolation, networking and storage according to the configuration you choose.
Build container images from instructions such as a Dockerfile.
Pull and push images through container registries.
Create, start, stop, inspect and remove containers.
Create networks so containers can communicate with each other or external services.
Attach persistent storage using volumes or bind mounts.
Run multi-container applications using Docker Compose.
If you first need the underlying concept, read What is Container?. Docker builds on containerisation rather than replacing it.
How does Docker work?
Docker uses a client and daemon architecture. The Docker client sends commands to the Docker daemon, dockerd, which manages Docker objects including images, containers, networks and volumes. The client and daemon can be on the same machine or communicate remotely through the Docker API.
You run a command such as docker run.
The Docker client sends the request to Docker Engine.
If the required image is not available locally, Docker pulls it from the configured registry.
Docker creates a writable container layer from the image.
Docker configures the requested network and storage resources.
Docker starts the container and executes its configured process.
Docker's official Docker overview documents this client, daemon, image and container lifecycle.
Docker image vs Docker container
A Docker image and a Docker container are related but not interchangeable. An image is the packaged, read-only template used to create containers. A container is a runnable instance of an image with its own writable layer and runtime state.
Image: the packaged application filesystem and configuration used as the starting point.
Container: an isolated running process created from an image.
Image layer: a filesystem change that can be reused between related images.
Container writable layer: changes made while that specific container is running.
Registry: a service used to store and distribute images.
The Open Container Initiative image specification defines an interoperable image format built from a manifest, optional image index, filesystem layers and configuration.
Docker vs a virtual machine
Containers and virtual machines both isolate workloads, but the isolation boundary is different. A conventional virtual machine includes a guest operating system and virtualised hardware. Linux containers normally share the host kernel while isolating processes and resources with operating system mechanisms such as namespaces and control groups.
Docker container: typically smaller, starts quickly and shares the host kernel.
Virtual machine: includes a guest operating system and normally has a stronger isolation boundary from the host.
Container: well suited to packaging services and repeatable application environments.
Virtual machine: useful when a separate operating system, kernel or stronger virtualisation boundary is required.
For the fuller comparison, see What is Virtual Machine?.
What are Docker Engine, Docker Desktop and Docker Compose?
Docker Engine: the core client and daemon technology used to build and run containers.
Docker Desktop: a desktop application for working with Docker on supported desktop operating systems, including the environment needed to run Linux containers where required.
Docker Compose: a way to define and run applications made from multiple containers using a Compose configuration file.
These names describe different parts of the Docker ecosystem. Installing Docker Desktop is not the same thing as the Docker container format, and Docker Compose is not a separate type of container.
How Docker networking works
A container can have its own network namespace, interfaces, addresses and routes. Docker can connect containers through network drivers, commonly using a bridge network on a single Linux host. Containers on an appropriate Docker network can communicate with each other, while published ports can make a service reachable through the host.
A published container port is closely related to the wider networking concepts explained in What is Port? and What is Port Forwarding?, but Docker's local port publishing is configured at the container host rather than being the same thing as forwarding a port through your broadband router.
Container networking can also involve IP addresses, DNS and firewall policy. A service working inside a container does not automatically mean it is reachable from another device or from the internet.
Docker storage: writable layers, volumes and bind mounts
The writable layer of a container is tied to that container. If important application data must survive replacement of the container, it should normally be stored outside that disposable writable layer. Docker volumes are managed by Docker, while bind mounts map a host path into a container.
Container writable layer: convenient for ephemeral changes but not a good place for data that must outlive the container.
Volume: Docker-managed persistent storage that can be attached to containers.
Bind mount: exposes a selected host file or directory path inside the container.
Does Docker make an application portable?
Docker improves application portability by packaging the application and its user-space dependencies, but portability is not unlimited. The target still needs a compatible container environment, CPU architecture and operating system expectations. Hardware devices, kernel capabilities, storage paths, networking and external services can also affect whether a workload runs unchanged.
Multi-platform images can provide different image manifests for different architectures. That is different from one arbitrary binary magically running on every processor or operating system.
How much broadband data does pulling a Docker image use?
Downloading an image from a remote registry transfers its image layers over your internet connection. The exact amount depends on which layers are already cached locally, compression, the selected image and registry behaviour.
Techie Broadband theoretical example: assume a completely uncached 2 GB decimal image requires 16 gigabits of payload data. At a sustained 100 Mbps payload rate, 16,000 megabits divided by 100 megabits per second equals 160 seconds, or about 2 minutes 40 seconds. At 1 Gbps, the same payload calculation is 16 seconds.
Those figures are payload-only theoretical transfer times. Real pulls can take longer because of protocol overhead, latency, registry performance, layer processing, decompression, storage writes, congestion and other bottlenecks. Cached layers can also make a later pull much smaller than the full image size.
This is why bandwidth and latency affect different parts of the experience. More bandwidth reduces bulk transfer time, while lower latency can improve repeated request and response interactions.
Docker and UK broadband
Docker itself does not require a particular UK access technology. It can be used over FTTP, FTTC, cable, fixed wireless or mobile broadband. The access network matters when images, build layers or application data cross the internet.
Download capacity affects image pulls and package downloads.
Upload capacity affects pushing images to remote registries and uploading build artefacts.
Latency can affect interactive remote development, API calls and many small registry transactions.
Packet loss or unstable connectivity can disrupt long transfers or remote sessions.
Local Ethernet, WiFi, storage and CPU can become the bottleneck even when the broadband service is fast.
On multi-gigabit broadband, a slow SSD, 1 Gbps Ethernet link, underpowered router or remote registry can limit the observed transfer rate before the broadband line does.
Is Docker secure?
Docker provides isolation, not an automatic security guarantee. Docker Engine uses operating system security mechanisms, and its security depends on the host kernel, daemon configuration, container privileges, image supply chain and application configuration.
The UK National Cyber Security Centre's containerisation guidance recommends securing both container images and the execution environment. It also warns that the boundary between a container and its host is less robust than the boundary between a conventional virtual machine and its host.
Use trusted images and understand where they came from.
Keep the host, Docker Engine and application dependencies patched.
Avoid unnecessary privileged containers and capabilities.
Do not bake passwords, API keys or other secrets into images.
Expose only the network ports that are actually required.
Use appropriate resource limits and host hardening.
Treat persistent data and backups separately from disposable containers.
Common Docker use cases
Local development environments that reproduce application dependencies consistently.
Web applications split into frontend, API, database and supporting services.
Self-hosted applications and homelab services.
Continuous integration and deployment pipelines.
Microservices where separate components are packaged and deployed independently.
Temporary test environments that can be recreated from known images.
For applications exposing APIs, see What is API (Application Programming Interface)?. For remote administration of a Docker host, SSH is another related concept.
Common Docker misconceptions
Docker is a container platform, not another name for every container technology.
A Docker image is not a running container.
A container is not automatically a virtual machine.
Deleting and recreating a container can remove data stored only in its writable layer.
Publishing a port does not automatically make a service safely reachable from the public internet.
Fast broadband does not guarantee fast container performance after the image has been downloaded.
How to troubleshoot a Docker container that is not reachable
Confirm the container is actually running and check its logs.
Confirm the application inside the container is listening on the expected address and port.
Check the container's network configuration and which Docker network it is attached to.
Confirm the required container port has been published to the host when host access is needed.
Test from the Docker host before testing from another LAN device.
Check the host firewall and any security rules.
If remote internet access is intended, separately check router, NAT, public IP or CGNAT behaviour and firewall policy.
If the service is slow rather than unreachable, isolate broadband, LAN, storage, CPU, memory and remote-service bottlenecks.
Do not immediately blame the broadband connection. The fault may be inside the container, at the Docker host, in the firewall, on the LAN, or beyond the ISP.
Frequently asked questions about Docker
Is Docker free?
Docker includes open source components such as Docker Engine, while some Docker products and services have separate licensing and subscription terms. The relevant terms depend on which Docker product you use and how you use it.
Is Docker only for Linux?
Linux containers rely on Linux kernel features. Docker tooling also runs on supported Windows and macOS systems, where the implementation can use a Linux virtual machine for Linux containers. Windows containers are a separate platform-specific case.
Do Docker containers have their own IP addresses?
They can. On common Docker networks, containers receive addresses within the Docker network. The exact behaviour depends on the network driver and configuration, and those addresses should not be confused with the public IP address of your broadband connection.
Does Docker replace virtual machines?
No. Containers and virtual machines solve overlapping but different problems. Containers are often efficient for application packaging and deployment; VMs remain useful when workloads need separate operating systems, kernels or a stronger virtualisation boundary.
Does Docker need fast broadband?
No. Docker can run entirely with local images and local services. Faster broadband mainly helps when pulling or pushing large images, downloading dependencies, using remote registries or accessing remote containerised services.
Key takeaway
Docker is a platform for building, distributing and running applications in containers. Its value comes from packaging applications consistently and managing the surrounding image, network, storage and runtime lifecycle. Containers are lighter than conventional VMs because they can share the host kernel, but that shared boundary also means Docker security must be treated deliberately. For broadband users, connection speed matters most when container data crosses the network; it does not replace the need for capable local hardware, correct networking and a healthy application stack.
To explore the related technical concepts used in this Docker guide, visit our broadband terminology guide.
