Engine Operations

Docker Desktop boots a small Linux virtual machine and runs dockerd inside it. The docker command you type on macOS or Windows is only a client talking to that daemon, so every Linux container is a process inside the VM.

docker image prune deletes only dangling images: untagged layers orphaned when a tag moved to a newer build. Adding -a deletes every image that no container references, including tagged images you still want.

docker inspect prints a JSON array holding the engine's full low-level record for each named object — State, Config, HostConfig, NetworkSettings, Mounts. --format (or -f) applies a Go template to each object, so docker inspect -f '{{.State.Status}}' web prints just that field.

The docker CLI reaches dockerd through the unix socket /var/run/docker.sock, which is owned by root and group docker. Add your user with sudo usermod -aG docker $USER, then open a new login session so the group takes effect.

Docker's default log driver is json-file: the daemon captures whatever a container writes to stdout and stderr and appends it as JSON lines to /var/lib/docker/containers/<id>/<id>-json.log on the host. A per-container --log-driver flag overrides that default.

The Docker daemon, not the CLI, verifies the registry's server certificate, and nothing in that chain is trusted on the daemon's host. Install the signing CA at /etc/docker/certs.d/<registry-host>:<port>/ca.crt, or in the host's system trust bundle.

A SIGHUP reload re-reads only part of daemon.json — registry mirrors, insecure registries, debug level, labels, live-restore, concurrency limits and runtimes. Structural settings such as storage-driver, data-root and the daemon's listen addresses are read only at start-up and need a full restart.

"The host" under Docker Desktop means its Linux VM, not macOS. --network host joins the VM's network namespace and binds the VM's interfaces, and macOS has no route in. Publish with -p instead, which Desktop forwards inward.

max-size caps one log file and max-file caps how many rotated copies are kept, bounding a container at roughly max-size times max-file. The json-file driver applies neither by default, and max-file does nothing unless max-size is set.

With --isolation=process a Windows container's processes run directly on the host's Windows kernel, so it starts fast and uses little memory but its base image build must match the host's. With --isolation=hyperv each container gets its own lightweight virtual machine and kernel, costing startup time and memory but removing that matching requirement.

Port 2375 is the plain, unauthenticated Engine API, and that API is root-equivalent: any caller can start a privileged container mounting the host root filesystem. Prefer an ssh:// endpoint, or dockerd --tlsverify on 2376, never publicly reachable.

Measure first with docker system df -v and du on the data root, then sweep in rising order of risk: stopped containers, dangling images, aged build cache, finally image prune -a with an until= filter.

A docker context is a saved name for one engine endpoint: a unix socket, a tcp:// URL or an ssh:// URL. docker context use points every later CLI command at that daemon, and DOCKER_HOST overrides the selected context.

/etc/docker/daemon.json is the Docker daemon's own configuration file: host-wide settings such as the default log driver, the storage driver, registry mirrors and data-root. dockerd reads it only at start-up, so an edit needs a daemon reload or restart.

A Docker engine serves one container operating system at a time. Once it is switched to Windows containers it asks the registry for a windows/amd64 image, and the image you pulled publishes only Linux entries, so nothing matches.

Docker Engine API paths carry the version, as in /v1.43/containers/json. A client calls GET /_ping first; the daemon answers with an Api-Version response header, and the client downgrades to that version when its own is newer. Negotiation never upgrades.

Both resolve on the daemon's host, not yours. A -v path is interpreted there, so a missing directory is created empty instead of mounting your files. The build context directory is read locally but uploaded to the daemon first.

Files stay on the host filesystem, so every open, stat and read crosses the VM boundary over a file-sharing protocol. A native Linux bind mount is a kernel operation with no crossing, so metadata-heavy trees suffer most.

docker system df totals four buckets: images, containers, local volumes, build cache. -v itemises them with each image's SHARED and UNIQUE size. RECLAIMABLE assumes the aggressive sweep, not what a default prune returns.

docker stats streams a live per-container table of CPU %, MEM USAGE / LIMIT, MEM %, NET I/O, BLOCK I/O and PIDS, refreshing until interrupted. --no-stream prints one sample and exits, which is what any script or CI step needs so the command terminates.

The docker CLI and dockerd speak a versioned REST API. The client normally negotiates down to the daemon's version; the refusal appears when that negotiation is bypassed or the daemon is too old. DOCKER_API_VERSION pins the client to a fixed version.

The docker CLI only talks to the daemon; dockerd makes the registry connection and never sees your shell environment. Configure the proxy on the daemon itself - a systemd drop-in, or the proxies block in /etc/docker/daemon.json - then restart it.

Treat GET /events as a long-lived stream that will break: reconnect with backoff, pass since set to the last event's time so the daemon replays the gap, and reconcile against GET /containers/json on every reconnect because that replay buffer is bounded.

Read the daemon's journal with journalctl -u docker: dockerd prints the exact configuration error before exiting - malformed JSON, an unrecognised key, or an option set both in daemon.json and as a unit flag. Move the file aside to recover.

Every container's ceiling is the VM's, not the laptop's. On macOS the CPU, memory, swap and virtual-disk limits come from Docker Desktop's resource settings; with the Windows WSL 2 backend they come from the .wslconfig file, because the memory belongs to WSL.

Run docker events filtered to the actions you care about — --filter event=die --filter event=oom --filter event=health_status — and capture it to a file, because the stream is live and the daemon's replay buffer is small. Each die event carries the container's exitCode as an attribute.

Use Docker's docker-ce repository packages with an explicit pinned version for servers and build hosts; the get.docker.com convenience script is for quick throwaway boxes, not production; Docker Desktop is a licensed developer workstation product, not a server install.

Only json-file, local and journald keep messages where the daemon can replay them. Shipping drivers send them away, so since Docker 20.10 the daemon writes a bounded local cache to answer reads; the none driver is never readable.

Process isolation requires the image's Windows build to match the host's, so an upgraded host rejects an image built on the old base with "The container operating system does not match the host operating system." Compare the image's OsVersion with the host build, then rebuild on the matching base tag or run it under Hyper-V isolation meanwhile.