Understanding Layers in Docker Engine

Docker Engine General
1

I’m having trouble getting my head wrapped around this…

If I have a Docker Engine running in Ubuntu and then I build a Dockerfile with something like this:

FROM centos

RUN yum -y update && yum -y install
apache

What exactly is going to happen here? Is it going to build a centos layer(s) that essentially contains diffs between the centos base and Ubuntu where the Engine is running? And then another layer(s) for the Apache package install?

Even though this works, would this be frowned upon…or not really since the objective is a Docker image should run in any Docker engine, regardless of the base Linux OS?

2

Containers are isolated from the host operating system and its filesystem. The “centos” image provides the basis for the image that you’re building there, so the container filesystem will only have the files from the centos image and whatever changes you make in your Dockerfile.

3

OK, so essentially all the files and layout defined in the centos image plus (in this case) all the files defined in the apache package. But the kernel in this case is still Ubuntu, correct? So all system calls, file i/o, etc. are ultimately performed by the OS hosting the Docker engine, right?

4

Correct. This is the underlying technology used by Docker (all other similar products): https://en.wikipedia.org/wiki/LXC

5

But the kernel in this case is still Ubuntu, correct? So all system calls, file i/o, etc. are ultimately performed by the OS hosting the Docker engine, right?

Yes, but not the complete kernel is used for a Docker container. Only a lightweight snapshot (encapsulation) of the kernel is used for each of the several containers running on a host. The host does not directly perform system calls, file i/o, but each container has its own filesystem and networking.

6

Ahhh…that is a great distinction, thank you. I didn’t realize each container had its own encapsulated kernel. Is there any documentation that talks about this more in depth?

7

"Containers include the application and all of its dependencies, but share the kernel with other containers. They run as an isolated process in userspace on the host operating system. "

Refer Containers sub-section in How is this different from virtual machines?