Kepriye cara Docker makaryo ing ngisor tutuk?

Question

Accepted Answer

Docker nggunakake fitur kernel Linux — **namespaces** (isolasi), **cgroups** (kontrol sumber daya), lan **union filesystems** (gambar berlapis) — kanggo nggawe containers sing ringan. Mangerteni mekanisme sing ndasar nerangake carane containers entuk isolasi lan efisiensi.

## Namespaces — isolasi

```text
Linux NAMESPACES isolate what a process can SEE — giving each container its own view:
  PID namespace     → its own process tree (container sees only its processes)
  NET namespace     → its own network interfaces, IPs, ports
  MNT namespace     → its own filesystem mounts
  UTS namespace     → its own hostname
  IPC, USER namespaces → isolated IPC, user/group ID mapping
→ Namespaces are WHY a container feels like a separate machine (isolated view),
  while actually sharing the host kernel.
```

## cgroups — kontrol sumber daya

```text
Control Groups (CGROUPS) LIMIT and account for resource usage per container:
  → CPU, memory, disk I/O, network bandwidth
→ cgroups are WHY you can set resource limits (-m, --cpus) — the kernel enforces them.
```

## Union filesystem — gambar berlapis

```text
UNION/OVERLAY filesystems (overlayfs) stack image LAYERS:
  → read-only image layers + a thin writable container layer on top, merged into one view
  → layers are SHARED between images/containers (one copy on disk) → space-efficient
→ This is WHY images are layered, cached, and shareable, and containers are lightweight.
```

## Arsitektur

```text
Docker CLI → Docker DAEMON (dockerd) → containerd → runc (creates containers using
  namespaces + cgroups). The daemon manages images, containers, networks, volumes.
→ Containers are just ISOLATED PROCESSES on the host (not VMs) — using kernel features,
  sharing the host kernel → lightweight and fast.
```

## Dene iki penting

Mangerteni carane Docker makaryo ing ngisor tutuk minangka ilmu tingkat senior sing bernilai sabab **ngilangake misteri containers** lan nerangake properti-properti utama (isolasi, efisiensi, kontrol sumber daya), nambah kemampuan kanggo nalarke, nata, lan mbetulake sistem sing ngemasi kontainer.

Insight krusial yaiku **containers dudu VMs — iku proses terisolasi ing host** nggunakake fitur kernel Linux, dene iki dadi alasan apa containers ringan lan cepet (berbagi kernel host tinimbang mbukak operating system kapisah).

Mangerteni **telu mekanisme inti** nerangake properti-properti: **namespaces** mengisolasi apa sing bisa ditonton proses (proses tree dewe, jaringan, filesystem, hostname — dene iki alesan *kenapa* container krasa minangka mesin kapisah sanajan berbagi kernel), **cgroups** mbatesi lan merhitungake panggunan sumber daya (dene iki alesan *kenapa* sampeyan bisa setèl CPU lan batas memori — kernel meksani), lan **union/overlay filesystems** numpuk layer gambar (dene iki alesan *kenapa* gambar berlapis, cached, lan bisa tunggal, lan containers ringan — layer read-only tunggal ing kontainer karo layer writable tipis ing ndhuwur).

Mangerteni **arsitektur** (CLI → daemon → containerd → runc, karo daemon ngatur kabèh) menehi gambar lengkap carane Docker operate.

Pamahaman sing luwih jero iki ndulur pamikiran babagan batas isolasi (lan implikasi security-ne, sanajan containers berbagi kernel), nerangake karakteristik performance lan efisiensi, lan tulungi troubleshooting.

Sanajan mangerteni mekanisme sing ndasar (namespaces, cgroups, union filesystems) nerangake *kenapa* containers tumindak kaya apa — isolasi-ne, efisiensi, kontrol sumber daya, lan fakta penting apa yen iku berbagi kernel host (karo implikasi security) — lan nambah kemampuan kanggo gawe sistem kang ngemasi kontainer karo manteb, mangerteni carane Docker makaryo ing ngisor tutuk minangka ilmu tingkat senior sing bernilai, ngangkat saking nggunakake Docker dadi bener-bener mangerteni, topik sing nunjukake jero sing diintisari kanggo peran senior lan migunani kanggo nalarke tingkah containers, batas security, lan performance.