Intuition The ONE core ideaA running program is really just a process the operating system is executing, wrapped in a bubble that hides everything else on the computer from it . Docker's entire vocabulary — image, container, layer, volume, port mapping — is just names for how you build that bubble, freeze it, ship it, and run it identically anywhere .
Before you can read a single Docker command in the parent note , you need a handful of words that the parent assumes you already own : what a "process" is, what a "filesystem" is, what a "kernel" is, what a "port" is. This page builds every one of them from absolute zero, in the order they depend on each other.
Everything below sits on top of one image. Look at it before anything else.
A process is simply one running program — a copy of your code that the computer is currently executing , together with the memory it is using right now. In the figure it is the amber box labelled "process". Your web server is a process; your database is another process.
The kernel is the innermost core of the operating system . It is the single piece of software that talks to the actual hardware (CPU, disk, network card) and hands out those resources to every process. In the figure it is the white slab at the bottom. Every process — yours, mine, Docker's — must ask the kernel to do anything real (read a file, send a network packet).
Intuition Why these two words first?The parent's headline claim — "a container is an isolated process that shares the host kernel " — is meaningless until you know that a process is a running program and a kernel is the shared core. A container is nothing more exotic than a process the kernel keeps in a bubble .
A filesystem is the tree of folders and files available to a program: /, /app, /usr/bin/python, and so on. When your program opens requirements.txt, it is asking the filesystem "give me the file at this path."
Look at the tree in the figure. Two ideas hide inside it:
A path is an address. /app/app.py is a route: start at the root /, go into app, pick the file app.py. This is why the parent's Dockerfile says WORKDIR /app — it sets the starting folder so later paths can be short.Two programs can be handed two different trees. This is the whole magic. If I give your web app a filesystem where /usr/bin/python is Python 3.12, and give another app a tree where it is Python 3.8, they never collide — even on one machine.
Intuition Why the topic needs "filesystem"The parent says an image is "a filesystem diff" and a layer is a "filesystem diff." You cannot understand a diff of a thing you can't picture. The thing being diffed is this tree of files.
Definition Diff (difference)A diff is just the list of changes between a "before" tree and an "after" tree: files added, files changed, files deleted. If layer A is "plain Ubuntu" and layer B is "Ubuntu after apt-get install python", the diff is only the new Python files — not a whole second copy of Ubuntu. That tiny-difference idea is why layers save disk space.
The parent drops two Linux terms without unpacking them: namespaces and cgroups . They are the two walls of the bubble.
A namespace is a kernel trick that lies to a process about what exists . A process inside a "PID namespace" thinks it is process number 1 and that no other processes exist. A process inside a "mount namespace" sees only its own filesystem tree. It is a one-way mirror: the process sees only its bubble; the host sees everything.
Definition cgroup (control group)A cgroup is a kernel meter that caps how much a process may consume — "you may use at most 512 MB of memory and half of one CPU core." Namespaces decide what you can see ; cgroups decide how much you can use .
Intuition Why the topic needs these two"Container = isolated process" is the parent's core definition, and isolation is literally these two mechanisms. Namespaces give the walls (you can't see the neighbours); cgroups give the rations (you can't starve the neighbours). Deeper detail lives in Linux Namespaces and cgroups .
Common mistake Thinking a container is a tiny virtual machineFeels right: it boots, it has its own files, its own processes — surely it's a mini-computer.
Reality: there is no second operating system inside a container. It is one ordinary host process that the kernel has fenced off with namespaces and cgroups. That is exactly why it starts in milliseconds while a VM takes seconds — see Virtual Machines vs Containers .
A port is a numbered door on a computer for network traffic . One machine has one network address but 65 535 ports; a web server listens on port 8000, a Postgres database on 5432. The number tells incoming traffic which program it is meant for.
Because a container lives in its own network bubble, its port 8000 is inside the bubble — the outside world can't knock on it directly. So Docker installs a forwarding rule :
Port mapping -p HOST:CONTAINER says "traffic arriving at the host's door number HOST is carried through to the container's door number CONTAINER ." In the figure, -p 8080:8000 connects the host's outer door 8080 to the container's inner door 8000.
Intuition Why the topic needs thisThe parent's rule "Host is the Hello, Container is the Code" is meaningless unless you already picture two separate sets of doors — the host's and the container's — joined by a hose. That's this figure.
-p 8080:8000 backwards
Feels right: "my app runs on 8000, so 8000 should be on the left."
Reality: the left is always the outside (host) — the door strangers knock on. The right is inside the container. Left = where you connect, right = where the app listens.
Definition Environment variableAn environment variable is a named piece of text handed to a process when it starts , like DATABASE_URL=postgres://db:5432/mydb. The program reads it by name instead of hard-coding the value. Think of a sticky note taped to the process: "the database is over here."
Intuition Why the topic needs itThe parent's compose file sets environment: - DATABASE_URL=.... This is how you configure the same image differently in development vs production without rebuilding it — the heart of Environment Variables and 12-Factor App .
Ephemeral means short-lived, gone when the thing that held it disappears . A container's writable top layer is ephemeral: delete the container, delete the data.
A volume is storage that lives outside the container's bubble , so it survives when the container is deleted. It is the parent's fix for "my database data disappeared." Details in Volumes and Persistent Storage .
Intuition Why picture this nowThe parent's biggest "gotcha" — data lost on docker compose down — only makes sense once you hold two separate ideas: the ephemeral writable layer (inside the bubble) versus the persistent volume (outside it).
YAML is a plain-text format for describing structured data using indentation . docker-compose.yml is YAML: nesting (indentation) shows what belongs to what — ports and environment are indented under web because they configure the web service.
A hostname is a human-friendly name that stands in for a network address , like typing db instead of 172.18.0.3. Compose registers each service's name as a hostname on a shared network, which is why web can reach db just by writing db.
Intuition Why the topic needs bothCompose is declarative : you describe the desired stack (in YAML) instead of running commands. And services talk by name (hostname) not number. Both words are assumed, never defined, in the parent.
Read it top-down: process + kernel + isolation give you a container ; filesystem → diff → layer give you an image ; ports, env vars, YAML and hostnames are the extra words you need before docker-compose makes sense.
Cover the right side and test yourself. If any answer is fuzzy, re-read its section before opening the parent.
A process is one running program plus the memory it is currently using.
The kernel is the core of the OS that talks to hardware and hands resources to every process; all containers share the host's one kernel.
A filesystem is the tree of folders and files a program can see, addressed by paths like /app/app.py.
A diff is the list of changes (added / changed / deleted files) between a before-tree and an after-tree — the basis of a layer.
A namespace makes a process see only its own bubble (its own processes, its own files) — the walls of isolation.
A cgroup caps how much CPU/memory a process may use — the rations of isolation.
A port is a numbered door for network traffic that says which program the traffic is for.
-p 8080:8000 meanshost door 8080 forwards to container door 8000 — left is outside (host), right is inside (container).
An environment variable is a named text value handed to a process at start, so config isn't hard-coded.
Ephemeral means gone when its holder disappears — like a container's writable layer.
A volume is storage kept outside the container so data survives deletion.
YAML is an indentation-based plain-text format for describing structured data, used by docker-compose.yml.
A DNS hostname is a friendly name standing in for a network address, letting web reach db by name.
