# What Is Docker? Containers, Images, and How It Works

> Docker is a platform for packaging and running apps in containers. Learn images, containers, Compose, how Docker works, Docker vs VM, and what to check first.

**URL:** https://www.ciptadusa.com/blog/docker-adalah  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Engineering  
**Published:** 2026-11-03  
**Cover:** https://www.ciptadusa.com/media/uploads/blog/2026-11/1793672345905-docker-adalah-20261103.webp  

## Article

Docker is an open platform for developing, shipping, and running applications inside containers, which are isolated environments that hold everything an application needs to run. Docker separates applications from their infrastructure, so the same application can run on a developer laptop, an office server, or the cloud without relying on whatever software is already installed on that machine ([source](https://docs.docker.com/get-started/docker-overview/)).

One point to clear up first: Docker is not an operating system and not a virtual machine. It uses Linux kernel features to create isolated processes, and all containers on one machine share the same kernel ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/)). This article covers what Docker is, its main components, how it works, how it differs from a VM, what it does for a business, and what to check before running it in production.

## What Docker Means

The official documentation describes Docker as an open platform for developing, shipping, and running applications. Docker lets you package and run an application in a loosely isolated environment called a container. Containers are lightweight and contain everything needed to run the application, so anyone who receives the same container gets an application that behaves the same way ([source](https://docs.docker.com/get-started/docker-overview/)).

IBM notes that the word "Docker" refers to several things at once: Docker Engine (the runtime for building and running containers), Docker, Inc. (the company that sells the commercial version), and the Docker open source project. IBM also notes that Docker was released publicly as open source in 2013 ([source](https://www.ibm.com/think/topics/docker)).

### What Is a Container?

A container is an isolated process for each component of an application. Docker gives the example of a web app with three parts: a React frontend, a Python API, and a PostgreSQL database. Each one can run in its own container. According to the Docker documentation, containers have four properties ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/)):

- Self-contained: each container carries what it needs, with no reliance on dependencies pre-installed on the host.
- Isolated: containers have minimal influence on the host and on other containers.
- Independent: each container is managed separately, and deleting one does not affect the others.
- Portable: a container that runs on a developer machine runs the same way in a data center or in the cloud.

Docker did not invent containers. Container technology existed for years before Docker, but Docker made containerization faster and easier ([source](https://www.ibm.com/think/topics/docker)).

## Docker's Main Components

A handful of terms come up throughout Docker documentation and tutorials. This table summarizes them from the official Docker docs.

| Component | Short explanation |
|---|---|
| Docker Engine / daemon (dockerd) | Background process that listens for Docker API requests and manages images, containers, networks, and volumes ([source](https://docs.docker.com/get-started/docker-overview/)) |
| Docker client (docker) | CLI commands such as docker run that are sent to the daemon ([source](https://docs.docker.com/get-started/docker-overview/)) |
| Dockerfile | A file with the instructions for building an image ([source](https://docs.docker.com/get-started/docker-overview/)) |
| Image | A read-only template with instructions for creating a container ([source](https://docs.docker.com/get-started/docker-overview/)) |
| Container | A runnable instance of an image |
| Registry | Where images are stored; Docker Hub is the default public registry, and you can run a private one ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-registry/)) |
| Volume | Persistent data storage for containers, created and managed by Docker ([source](https://docs.docker.com/engine/storage/volumes/)) |
| Docker Compose | A tool for defining and running multi-container applications from one YAML file ([source](https://docs.docker.com/compose/)) |
| Docker Desktop | An app for Mac, Windows, and Linux that bundles the daemon, client, Compose, and Kubernetes ([source](https://docs.docker.com/get-started/docker-overview/)) |

### Docker Image

An image is a standardized package with all the files, binaries, libraries, and configuration needed to run a container. The Docker docs stress two principles: images are immutable (once created they cannot be modified; you can only build a new image or add changes on top), and images are made of layers, each holding a set of file system changes ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-an-image/)).

Image formats and container runtimes are standardized by the Open Container Initiative (OCI), a Linux Foundation project launched on June 22, 2015 by Docker, CoreOS, and other container industry players. Docker donated its container format and the runC runtime to the OCI ([source](https://opencontainers.org/about/overview/)). Because of this standard, an image built with Docker can be run by other OCI-compatible runtimes.

### Docker Container

A container is a running image, and one image can start many containers. In this example from the Docker docs, the command runs a simple web server and maps port 8080 on the host to port 80 in the container ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/)):

```bash
docker run -d -p 8080:80 docker/welcome-to-docker
docker ps
```

### Docker Compose

A business application needs more than one component, such as a web app and a database. Docker Compose lets you describe all services, networks, and volumes in a single YAML file and start everything with one command ([source](https://docs.docker.com/compose/)). The compose.yaml below is a CDS illustration for a web app with a MySQL database:

```yaml
services:
  web:
    build: .
    ports:
      - "8080:8080"
    environment:
      DB_HOST: db
    depends_on:
      - db
  db:
    image: mysql:8.4
    environment:
      MYSQL_DATABASE: app
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db_root_password
    volumes:
      - db_data:/var/lib/mysql
    secrets:
      - db_root_password
volumes:
  db_data:
secrets:
  db_root_password:
    file: ./db_root_password.txt
```

Running docker compose up then builds the web image, pulls the MySQL image, and starts both on a shared network.

## How Docker Works

Docker uses a client-server architecture. The Docker client talks to the Docker daemon, which does the work of building, running, and distributing containers. The client and daemon can run on the same machine or on different ones, and they communicate through a REST API over UNIX sockets or a network interface ([source](https://docs.docker.com/get-started/docker-overview/)).

The workflow looks like this:

1. A developer writes a Dockerfile describing the base image, dependencies, code, and the command that starts the application.
2. The docker build command produces a layered image from that Dockerfile.
3. The image gets a version tag and is sent to a registry with docker push.
4. The target server pulls the image with docker pull, or directly with docker run, and the daemon creates a container from it.
5. When there is a fix, the team builds a new image and replaces the old container with the new version.

Under the hood, Docker is written in Go and uses a Linux kernel feature called namespaces to create isolated workspaces. Each container gets its own set of namespaces, and each aspect of the container is limited to its namespace ([source](https://docs.docker.com/get-started/docker-overview/)). Limits on CPU and memory are handled by control groups (cgroups), a kernel feature whose code was started in 2006 ([source](https://docs.docker.com/engine/security/)).

## Docker vs Virtual Machine

A virtual machine (VM) is a whole operating system with its own kernel, drivers, programs, and applications. Starting a VM just to isolate one application adds a lot of overhead. A container is an isolated process with the files it needs, and all containers on a host share the same kernel ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/)).

CDS compiled the following table from the Docker and AWS documentation:

| Aspect | Docker container | Virtual machine |
|---|---|---|
| Contents | The app plus libraries, runtime, and configuration | A full guest operating system plus the app |
| Kernel | Shares the host kernel | Its own kernel per VM |
| What is virtualized | The application environment on top of the host OS | The hardware |
| Resource overhead | Light, can be packed densely on one server | Heavier, since each VM carries an OS |
| Used together? | Can run inside a VM | Can host many containers |

AWS explains that Docker containers use the host operating system's kernel resources directly, while a VM is a digital copy of a physical machine with its own operating system, and that Docker containers can also run inside VMs ([source](https://aws.amazon.com/compare/the-difference-between-docker-vm/)). Docker describes this combined pattern in the cloud: one VM with a container runtime runs several applications at once to raise utilization and cut costs ([source](https://docs.docker.com/get-started/docker-concepts/the-basics/what-is-a-container/)).

## What Docker Does for Teams and Businesses

The Docker documentation lists three main uses ([source](https://docs.docker.com/get-started/docker-overview/)):

- Fast, consistent delivery: developers work in standardized environments, and containers fit continuous integration and continuous delivery (CI/CD) workflows. A bug fix reaches customers by pushing the updated image to production.
- Responsive deployment and scaling: containers run on laptops, physical or virtual servers in a data center, cloud providers, or a mix, and can be scaled up or torn down as business needs change.
- More workloads on the same hardware: Docker is a cost-effective alternative to hypervisor-based VMs, including for small and medium deployments.

In everyday IT terms, this addresses the classic "it works on my laptop but not on the server" problem. Because the image carries the same runtime and library versions, staging and production run an identical package.

### Docker Examples

A real example from CDS: Zetta CRM, the open source CRM backend for AI agents incubated by CDS, ships as an image on GitHub Container Registry (GHCR). Users run docker pull ghcr.io/incredible-zetta/crm:v0.5.0 to get that version ([source](/en/incubating/zetta-crm)).

Another pattern shown in the Docker docs is splitting the web application, database, and cache into separate containers so each is easier to scale and reuse ([source](https://docs.docker.com/build/building/best-practices/)). In a [microservices](/en/blog/microservices-adalah) architecture, each service is packaged as its own image so it can be released independently.

## Docker, Kubernetes, and Docker Compose: What's the Difference?

The three complement each other rather than replace each other:

- Docker builds images and runs containers on one host.
- Docker Compose runs several related containers from one configuration file ([source](https://docs.docker.com/compose/)).
- Kubernetes is an open source platform for managing containerized workloads and services across many machines, with declarative configuration and automation ([source](https://kubernetes.io/docs/concepts/overview/)).

For an internal application on one or two servers, Docker plus Compose can be enough. Kubernetes becomes relevant once you run many services across many nodes and need scheduling, self-healing, and automated rolling updates. This assessment is CDS internal guidance, not a fixed rule.

## What to Check Before Using Docker

Docker makes deployment easier, but it does not make a system secure or tidy on its own. Some points from the official docs:

- The Docker daemon requires root privileges unless you use Rootless mode, so only trusted users should control the daemon ([source](https://docs.docker.com/engine/security/)). Rootless mode runs the daemon and containers as a non-root user ([source](https://docs.docker.com/engine/security/rootless/)).
- If a service can run without privileges, use the USER instruction in the Dockerfile so it runs as a non-root user ([source](https://docs.docker.com/build/building/best-practices/)).
- Do not put passwords or API tokens in build arguments or environment variables during the build, because they persist in the final image. Use secret mounts instead ([source](https://docs.docker.com/build/building/secrets/)).
- When a container is removed, its writable layer is removed with it. Keep data that must survive, such as a database, in a volume ([source](https://docs.docker.com/engine/storage/volumes/)).
- Design containers to be ephemeral (stopped, destroyed, and replaced with minimal setup), use multi-stage builds to shrink images, and pin base image versions because image tags are mutable ([source](https://docs.docker.com/build/building/best-practices/)).
- Check the Docker Desktop license. Docker Desktop is free for small businesses (fewer than 250 employees and less than US$10 million in annual revenue), personal use, education, and non-commercial open source projects. Larger organizations and government entities need a paid subscription ([source](https://docs.docker.com/subscription/desktop-license/)).

Container and server security also ties into [DevOps](/en/blog/devops-adalah) practice as a whole: the build pipeline, image scanning, and monitoring after release.

## First Steps to Adopt Docker in a Business Project

The sequence below is CDS internal guidance for teams just getting started:

1. Pick one application whose deployments break because of environment differences, such as a [backend](/en/blog/backend-adalah) that needs a specific runtime version.
2. Write a Dockerfile, test the build on a developer laptop, and make sure secrets do not end up in the image.
3. Add docker compose to run the app with its database and other dependencies in local and staging environments.
4. Put docker build into the CI pipeline so every release produces a versioned, traceable image.
5. Decide on a registry (public or private), a volume backup strategy, and monitoring before moving to production.
6. Evaluate orchestration such as Kubernetes only when the number of services and servers calls for it.

If your applications exchange data through an [API](/en/blog/api-adalah) or need a [data migration](/en/blog/migrasi-data-adalah) to new servers, containerization can be part of the same migration plan.

## Docker FAQ

### What is Docker in simple terms?

Docker is a tool that wraps an application and everything it needs into a container, so the application runs the same way on any computer, server, or cloud ([source](https://docs.docker.com/get-started/docker-overview/)).

### Is Docker an operating system?

No. Docker runs on top of an operating system and uses Linux kernel features, such as namespaces, to create isolated containers. Containers share the host kernel rather than carrying their own ([source](https://docs.docker.com/get-started/docker-overview/)).

### What is the difference between a Docker image and a Docker container?

An image is a read-only template with instructions for creating a container, while a container is a running instance of that image ([source](https://docs.docker.com/get-started/docker-overview/)).

### What is Docker Hub?

Docker Hub is a public registry anyone can use to store and pull images, and it is where Docker looks for images by default ([source](https://docs.docker.com/get-started/docker-overview/)).

### What is Docker Compose?

Docker Compose is a tool for defining and running multi-container applications. Services, networks, and volumes are written in one YAML file and started with a single command ([source](https://docs.docker.com/compose/)).

### Is Docker free?

Docker comes from an open source project released publicly in 2013 ([source](https://www.ibm.com/think/topics/docker)). Docker Desktop is free for small businesses, personal use, education, and non-commercial open source projects, but larger organizations and government entities need a paid subscription ([source](https://docs.docker.com/subscription/desktop-license/)).

## Need Help Setting Up Docker for Your Application?

The CDS team builds web apps, APIs, and dashboards complete with staging and production environments and CI/CD pipelines through our [custom software development service](/en/services/software). If you want an existing system audited and a migration path to containers mapped out, start with [IT consulting](/en/services/consulting). You can also look at [Zetta CRM](/en/incubating/zetta-crm) as an example of a CDS product shipped as a Docker image, or browse [CDS works](/en/works).


---

*Markdown version of https://www.ciptadusa.com/blog/docker-adalah — generated for AI agents and LLM crawlers.*