Docker inafanya kazi vipi chini ya jembe?

Question

Accepted Answer

Docker hutumia vipengele vya Linux kernel — **namespaces** (kuzigawanya), **cgroups** (kudhibiti rasilimali), na **union filesystems** (picha zilizokamatika) — kuunda kontena nyepesi. Kuelewa mitaratibu ya msingi inaeleza jinsi kontena zinavyofikia kuzigawanya na ufanisi.

## Namespaces — kuzigawanya

```text
Linux NAMESPACES isolate what a process can SEE — giving each container its own view:
  PID namespace     → its own process tree (container sees only its processes)
  NET namespace     → its own network interfaces, IPs, ports
  MNT namespace     → its own filesystem mounts
  UTS namespace     → its own hostname
  IPC, USER namespaces → isolated IPC, user/group ID mapping
→ Namespaces are WHY a container feels like a separate machine (isolated view),
  while actually sharing the host kernel.
```

## cgroups — kudhibiti rasilimali

```text
Control Groups (CGROUPS) LIMIT and account for resource usage per container:
  → CPU, memory, disk I/O, network bandwidth
→ cgroups are WHY you can set resource limits (-m, --cpus) — the kernel enforces them.
```

## Union filesystem — picha zilizokamatika

```text
UNION/OVERLAY filesystems (overlayfs) stack image LAYERS:
  → read-only image layers + a thin writable container layer on top, merged into one view
  → layers are SHARED between images/containers (one copy on disk) → space-efficient
→ This is WHY images are layered, cached, and shareable, and containers are lightweight.
```

## Miundo ya usanifu

```text
Docker CLI → Docker DAEMON (dockerd) → containerd → runc (creates containers using
  namespaces + cgroups). The daemon manages images, containers, networks, volumes.
→ Containers are just ISOLATED PROCESSES on the host (not VMs) — using kernel features,
  sharing the host kernel → lightweight and fast.
```

## Kwa nini inakusudiwa

Kuelewa jinsi Docker inafanya kazi chini ya jembe ni ujuzi wa kiwango cha juu unao na thamani kwa sababu inafanya **kontena ziwe wazi** na inaeleza mali zao kuu (kuzigawanya, ufanisi, kudhibiti rasilimali), na kuzamia uwezo wa kufikiri kuhusu, kusanidi, na kutatua matatizo ya mifumo iliyosakinishwa katika kontena.

Kukwama muhimu ni kwamba **kontena si mashine za virtual — ni michakato iliyozigawanywa kwenye seva ya nyumba** kwa kutumia vipengele vya Linux kernel, hii ndiyo sababu zina uzani mdogo na zina kasi (zinashiriki kernel ya seva badala ya kufanya kazi na OS tofauti).

Kuelewa **mitaratibu mitatu ya msingi** inaeleza mali: **namespaces** zinagawanya kile ambacho michakato inaweza kuona (mti wake wa michakato, mtandao, faili mfumo, jina la seva — ambalo ndiyo *kwa nini* kontena inakamatia kama mashine tofauti ingawa inashiriki kernel), **cgroups** zinalikita na kusambaza matumizi ya rasilimali (ambalo ndicho *kwa nini* unaweza kusanidi kuzuia kwa CPU na kumbukumbu — kernel inahakikisha), na **union/overlay filesystems** zinastaka tabaka za picha (ambalo ndicho *kwa nini* picha zina tabaka, tanzu, na zinakamatia, na kontena zina uzani mdogo — tabaka linalosomwa kwa kutengeneza ushirikiano katika kontena na tabaka nyepesi linaloko juu).

Kuelewa **miundo ya usanifu** (CLI → daemon → containerd → runc, na daemon inasimamia kila kitu) inatoa picha kamili ya jinsi Docker inavyofanya kazi.

Kuelewa kina zaidi kunasaidia kufikiri kuhusu mipaka ya kuzigawanya (na matokeo ya usalama, kwa sababu kontena zinashiriki kernel), inaeleza tabia ya utendaji na ufanisi, na inasaidia kutatua matatizo.

Kwa kuwa kuelewa mitaratibu ya msingi (namespaces, cgroups, union filesystems) inaeleza *kwa nini* kontena hukamatia jinsi wanavyo — kuzigawanya kwao, ufanisi, kudhibiti rasilimali, na ukweli muhimu kwamba zinashiriki kernel ya seva (na matokeo ya usalama) — na kuzamia uwezo wa kufanya kazi na mifumo iliyosakinishwa katika kontena kwa ujasiri, kuelewa jinsi Docker inafanya kazi chini ya jembe ni ujuzi wa kiwango cha juu unao na thamani unatakaokucheza kutoka kwa matumizi ya Docker kwenda kwa kuelewa kweli, mada inaonyesha kina kilichotakikia kwa nafasi za juu na inafaa kusababu kuhusu tabia ya kontena, mipaka ya usalama, na utendaji.