Docker from First PrinciplesHow to use this guide · 18 of 18 written
  1. How to use this guide
  2. 01The problem Docker solves
  3. 02What a container really is
  4. 03Images: layers, hashes and registries
  5. 04Docker's architecture
  6. 05Container lifecycle
  7. 06Dockerfiles in depth
  8. 07Storage: where data lives
  9. 08Networking
  10. 09Docker Compose for multi-service AI apps
  11. 10GPUs in containers
  12. 11Building good images for AI workloads
  13. 12Serving and production patterns
  14. 13Security
  15. 14Debugging and introspection
  16. 15Beyond Docker
  17. 16Hands-on learning path
  18. 17Question bank
  19. 18Glossary and cheat sheet

Docker from First Principles

AI Systems Infrastructure · 18 posts59m read

Docker starts ordinary Linux processes with three twists: a restricted view of the system (namespaces), capped resources (cgroups), and a root filesystem taken from an image. Everything else in this guide (Dockerfiles, volumes, networks, Compose, GPU support) is tooling built around those three ideas.

How to use this guide

The mental model in five sentences

  • An image is a read-only, layered snapshot of a filesystem plus a little metadata: which command to run, environment variables, working directory. It is identified by a content hash.
  • A container is a process tree started from an image, with a thin writable layer on top, its own namespaces and its own resource limits. When its main process exits, the container stops.
  • A Dockerfile is a build script whose output is an image.
  • A registry (Docker Hub, GHCR, NVIDIA NGC) stores and distributes images.
  • The daemon does all the work; the docker command is only a client that sends it API requests.

How the parts are organised

Parts 1 to 5 are foundations; read them in order, because later parts assume them. Parts 6 to 9 are the daily toolkit: Dockerfiles, storage, networking, Compose. Parts 10 to 12 are the AI-specific layer: GPUs, building ML images, serving models. Parts 13 to 15 cover security, debugging and what comes after Docker. Part 16 is a lab sequence, Part 17 a question bank with answers, and the last section a glossary and command sheet.

The fluency test

For any Docker behaviour you see, try to name which primitive causes it (namespace, cgroup, or filesystem layer) and which component does it (CLI, daemon, containerd, runc, registry, BuildKit). If you can’t name one, that gap is your next question. Most confusing Docker problems become obvious once you know which layer they live in.

A note on your machine

On an Apple Silicon Mac like your M1 Pro, Docker runs inside a hidden arm64 Linux VM, and containers cannot use the Mac’s GPU. You can learn almost everything here locally. For the GPU parts (Part 10 and the GPU labs), use a rented Linux machine with an NVIDIA GPU; Part 10 shows how to drive it from your Mac’s terminal.