What Is Docker? – Definition and How It Works
Learn what containers are, how images and layers work, how containers differ from virtual machines, and why they suit collection workloads.
Docker packages an application with its dependencies into an image that runs as an isolated process on any host with a compatible runtime. It makes "works on my machine" reproducible.
1. Images and Containers
- An image is a read-only template: a filesystem plus metadata describing how to start it.
- A container is a running instance of an image, with a writable layer on top.
- A registry stores and distributes images.
One image produces many identical containers, which is the property that makes deployment predictable.
2. Layers
Images are built in layers, each corresponding to a build instruction. Layers are cached and shared, so a rebuild after changing only application code reuses everything beneath it.
That is why instruction order matters: putting dependency installation before copying source code means a code change does not invalidate the dependency layer.
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "collect.py"]
3. Containers Versus Virtual Machines
| Aspect | Container | Virtual machine |
|---|---|---|
| Isolation | Process-level, shared kernel | Full, separate kernel |
| Start time | Milliseconds to seconds | Tens of seconds |
| Overhead | Small | A whole operating system |
| Density | Many per host | Fewer |
| Isolation strength | Weaker | Stronger |
Containers isolate dependencies and filesystems, not hardware — which is why untrusted workloads sometimes still warrant a virtual machine.
4. Why It Suits Collection Work
- Browsers and their dependencies are awkward to install consistently; an image fixes the version.
- Runs are reproducible, so a result can be reproduced months later.
- Scaling out is starting more containers.
- Isolation keeps one job's state out of another's.
- Scheduling platforms consume images natively.
5. Practical Notes for Browser Images
Browsers need more shared memory than the container default provides, and a small default frequently causes crashes that look like application bugs.
They also need their font and library dependencies present, which is why using a maintained browser image is usually better than assembling one.
6. Data and Configuration
Containers are ephemeral: anything written inside disappears when they stop. Persist through volumes or bind mounts, and supply configuration through environment variables rather than baking it in.
Secrets should never be in an image. Layers are inspectable, and a secret added and later deleted remains in the layer where it was added.
7. Image Size
Smaller images pull faster and expose less. Use a slim base, avoid caching package downloads inside layers, and use multi-stage builds so build tools do not ship in the final image.
8. Summary
Docker packages an application and its dependencies into a layered image that runs as an isolated container, reproducibly, on any compatible host.
For collection it fixes browser and library versions, makes runs reproducible, and scales by starting more containers — provided secrets stay out of images, data goes to volumes, and browser containers get the shared memory they need.