DOCKER - 8 While launching a container

In this lesson we look at what really happens behind the scenes when you run docker container run. It's tempting to think Docker only manages containers, but a lot more is going on every time you start one. The command name at the end (for example nginx) is the image Docker has to use, and the engine has a precise checklist to fulfil before your container is actually up.

The steps behind docker container run

First, Docker looks for the image locally in the image cache. If it's missing, the engine reaches out to Docker Hub — its default remote image registry — and pulls it. Because we didn't specify a tag, Docker picks the latest version automatically. The image is downloaded, cached locally, and ready to be used by any number of containers.

Once the image is available, Docker starts a new container based on it. Crucially, it does not copy the image: it stacks a writable layer on top of the read-only image layers and your changes live there. The engine then configures networking — the container receives a virtual IP on a Docker virtual network. If you provided --publish (for example 80:80), Docker forwards host port 80 to container port 80; without that flag, no port is exposed. Finally, the container starts the command defined in its Dockerfile, a topic covered in a later section.

  • Look up the image locally, then on Docker Hub if missing
  • Pull the requested tag (latest by default) and cache it
  • Create a new writable layer on top of the image
  • Allocate a virtual IP on Docker's virtual network
  • Forward host ports via --publish when specified
  • Execute the command declared in the Dockerfile

As you can see, plenty happens for a single command. We will dive into each of these areas — images, networking, ports, the Dockerfile — in the upcoming sections.

Summary

This lesson explains the complete behind-the-scenes process when executing `docker container run`. Docker searches for the specified image locally; if not found, it queries Docker Hub (the default remote repository), downloads and caches it. If no version tag is specified, Docker automatically pulls the "latest" version. Once the image is ready, a new container is created by layering changes on top, assigned a unique virtual IP address on Docker's virtual network, and configured with port mappings as specified.

Key points

  • Docker first searches for images locally; if not found, it fetches from Docker Hub and caches the image
  • Omitting a version tag defaults to pulling the 'latest' version of an image
  • Containers are created by adding new layers of changes on top of the base image, not by copying the entire image
  • Each container receives a unique virtual IP address within Docker's virtual network
  • Port mapping (e.g., -p 80:80) routes host traffic on specified ports to corresponding container ports
  • The container execution begins with the command specified in the Dockerfile's CMD or ENTRYPOINT instruction

FAQ

Where does Docker look for images when I run a container?

Docker first checks your local image cache. If the image is not found locally, Docker automatically searches Docker Hub (the default remote repository), downloads it, and stores it in your local cache for future use.

What happens if I don't specify a version or tag when running a container?

If you omit the version tag, Docker defaults to pulling the 'latest' version of the image from the repository.

Does Docker copy the entire image when creating a new container?

No. Docker creates a new container by layering additional changes on top of the base image rather than copying it. This approach is more efficient and keeps the original image unchanged.