Capstone: The Full Map

In one sentence: Every subsystem you designed snaps into one architecture — and if you can draw this map from memory, you understand container engines better than most people who use them daily.

MiniDock, assembled

Read it top to bottom as a life story: intent enters at the CLI or a compose file; the daemon resolves names to content, content to mounted filesystems; the runtime chain turns a bundle into a kernel-isolated process; storage and networking plug in from the sides; observability taps every seam; and above it all, an orchestrator repeats one loop that keeps many machines honest.

flowchart TB
  subgraph CP["control (P7)"]
    ORCH["orchestrator: observe→diff→act (L37)"]
    RAFT[("Raft state store (L36)")]
    ORCH --- RAFT
  end
  CLI["CLI / compose file (L1, L34)"] --> D["daemon (L1–3)"]
  ORCH --> D
  subgraph IMGS["images + distribution (P2–3)"]
    REG[("registry (L14–16)")]
    STORES[("ref · image · layer stores (L13)")]
    BLD["builder + cache (L10–12)"]
  end
  D --> BLD
  D <--> REG
  D --> STORES
  subgraph RT["runtime (P1, P4)"]
    MGR["manager → shim → OCI runtime (L3)"]
    K["kernel: namespaces (L4) · cgroups (L5) · sandwich (L6)"]
    CTN["container: lifecycle (L18) · health (L24) · supervision (L21)"]
    MGR --> K --> CTN
  end
  D --> MGR
  STORES -- "overlay mounts (L9, L20)" --> RT
  subgraph SIDE["storage + network (P5–6)"]
    VOL[("volumes (L25–27)")]
    NET["CNM: bridge · ports · DNS · overlay (L28–33)"]
  end
  VOL --> CTN
  NET --> CTN
  OBS["events · logs · metrics (L38)"]
  D -.-> OBS
  CTN -.-> OBS
  SEC["hardening wraps every seam (L39)"]
  style SEC fill:#f0faf2,stroke:#1f7a34
    

The five ideas underneath

Forty lessons compress to five principles you can reuse on any system: narrow waists (the bundle, the driver seams, the registry API — small interfaces that decouple worlds); content addressing (names that can't lie make caching, dedup, and trust one mechanism); lifecycle as state machine (events move the needle; reality outranks intent); declarative convergence (diff desired against actual, forever); and layered defense (independent walls, so one failure isn't the story). Docker is one arrangement of these; you now own the pieces to arrange your own.