The core idea
Docker has two halves. The docker CLI you type into is only a client. The work is done by the Docker daemon
(dockerd), a background service that builds images, pulls them from registries and runs containers. The CLI sends it
requests over a local socket and prints the replies.
Installing Docker means getting both halves running. Most problems in this lesson come from the daemon not running, or the CLI not being allowed to talk to it.
Pick an install
| You're on | Install | Notes |
|---|---|---|
| macOS or Windows | Docker Desktop | Runs a small Linux VM for your containers. Free for personal use, education and small businesses; larger companies need a paid plan. |
| Linux | Docker Engine | The daemon runs directly on your kernel. Open source and free. Docker Desktop for Linux also exists. |
| macOS, alternatives | OrbStack, Colima | Also provide a Linux VM and the same docker CLI. |
Follow the official instructions for your platform at docs.docker.com/get-docker. On Linux, prefer installing from
Docker's apt or dnf repository over your distribution's own docker.io package, which is often older.
Linux: running without sudo
On Linux the daemon's socket, /var/run/docker.sock, belongs to root and the docker group. To run docker without
sudo, add yourself to that group, then log out and back in:
$ sudo usermod -aG docker $USER
Know what that means: anyone who can talk to the daemon can start a container that mounts the host's / and do
anything as root. Being in the docker group is effectively root on that machine. Fine on your laptop; think twice
on shared servers. Docker's rootless mode, or Podman, avoids this by running containers without root on the host.
Check both halves
$ docker versionClient:Version: 29.1.3API version: 1.52...OS/Arch: darwin/arm64Server: Docker Desktop 4.56.0 (214940)Engine:Version: 29.1.3...
Output trimmed; your versions will differ. If you see a Client section but an error instead of Server, the CLI is
installed and the daemon isn't reachable.
Your first container
$ docker run hello-worldUnable to find image 'hello-world:latest' locallylatest: Pulling from library/hello-world...Hello from Docker!This message shows that your installation appears to be working correctly....
That one command did a lot:
- 01
CLI → daemon
The CLI sends a 'run hello-world' request over the Docker socket.
- 02
Look locally
The daemon checks for hello-world:latest in its local image store. It isn't there.
- 03
Pull
It downloads the image's layers from Docker Hub, docker.io/library/hello-world.
- 04
Create and start
It adds a writable layer, sets up namespaces and cgroups, and starts the process.
- 05
Stream output
The program prints its message and exits. Output streams back to your terminal.
Run it again and the "Unable to find image" and pull lines disappear: the image is cached locally now.
Something more useful
hello-world exits immediately. A web server keeps running:
$ docker run -d -p 8080:80 --name web nginx:alpine$ curl -s localhost:8080 | head -4<!DOCTYPE html><html><head><title>Welcome to nginx!</title>$ docker logs web...$ docker stop web$ docker rm web
-d runs it in the background. -p 8080:80 forwards port 8080 on your machine to port 80 in the container. You'll
look at each flag properly in 01.06 The Docker CLI, mapped.
docker ps fails with: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? What's the most likely cause?
See it yourself
Run docker version and check you see both Client and Server. Then run hello-world twice and notice the second run doesn't pull. Finally, open localhost:8080 in your browser while the nginx container from above is running.
STUCK? ▸
No Server section: start Docker Desktop, or run sudo systemctl start docker on Linux. Permission denied on Linux: add yourself to the docker group and log out and back in, or use sudo for now.
Recap
Interview questions
Walk me through what happens when you run docker run nginx.
Why is being in the docker group considered a security risk?