flowchart TB
    subgraph Client["客户端层"]
        CLI[docker CLI]
        SDK[Docker SDK]
        API_Client[其他 API 客户端]
    end
    
    subgraph API["API 网关层"]
        APIServer[API Server]
        Router[Router 注册中心]
        Middleware[中间件<br/>版本/鉴权/CORS]
    end
    
    subgraph Core["核心服务层"]
        Daemon[Daemon 核心]
        Container[容器管理]
        Image[镜像服务]
        Network[网络服务]
        Volume[卷服务]
        Builder[构建服务]
        Plugin[插件管理]
        Cluster[集群管理 Swarm]
    end
    
    subgraph Runtime["运行时层"]
        Containerd[containerd 客户端]
        Libnetwork[libnetwork]
        GraphDriver[存储驱动]
        IPAM[IPAM 驱动]
    end
    
    subgraph External["外部系统"]
        Registry[镜像仓库<br/>Docker Hub/私有仓库]
        ContainerdD[containerd 守护进程]
        NetDriver[网络驱动<br/>bridge/overlay/macvlan]
        VolumeDriver[卷驱动插件]
    end
    
    CLI --> APIServer
    SDK --> APIServer
    API_Client --> APIServer
    
    APIServer --> Middleware
    Middleware --> Router
    
    Router --> Daemon
    Router --> Container
    Router --> Image
    Router --> Network
    Router --> Volume
    Router --> Builder
    Router --> Plugin
    Router --> Cluster
    
    Container --> Daemon
    Image --> Daemon
    Network --> Daemon
    Volume --> Daemon
    Builder --> Daemon
    
    Daemon --> Containerd
    Daemon --> Libnetwork
    Daemon --> GraphDriver
    
    Containerd --> ContainerdD
    Libnetwork --> NetDriver
    Libnetwork --> IPAM
    
    Image --> Registry
    Volume --> VolumeDriver
    
    ContainerdD -.-> runc[runc/OCI 运行时]

sequenceDiagram
    autonumber
    participant CLI as docker CLI
    participant API as API Server
    participant Router as Container Router
    participant Daemon as Daemon
    participant Image as Image Service
    participant Container as Container Manager
    participant Containerd as containerd Client
    participant Network as Libnetwork
    participant ContainerdD as containerd 守护进程
    
    CLI->>API: POST /containers/create
    API->>Router: 路由到 Container Router
    Router->>Daemon: ContainerCreate(config)
    
    Note over Daemon: 1. 验证配置参数
    Daemon->>Image: GetImage(imageRef)
    Image-->>Daemon: 返回镜像信息
    
    Note over Daemon: 2. 创建容器对象
    Daemon->>Container: 分配容器 ID
    Daemon->>Container: 初始化容器配置
    
    Note over Daemon: 3. 设置网络
    Daemon->>Network: 创建沙箱
    Network-->>Daemon: 网络端点
    
    Note over Daemon: 4. 持久化容器元数据
    Daemon->>Daemon: 保存到 BoltDB
    
    Daemon-->>Router: 返回容器 ID
    Router-->>API: 201 Created
    API-->>CLI: {"Id": "abc123..."}
    
    Note over CLI: 用户执行 docker start abc123
    
    CLI->>API: POST /containers/abc123/start
    API->>Router: 路由到 Container Router
    Router->>Daemon: ContainerStart(id)
    
    Note over Daemon: 5. 验证容器状态
    Daemon->>Container: 检查是否已启动
    
    Note over Daemon: 6. 准备 OCI 规范
    Daemon->>Daemon: 构建 OCI Spec
    
    Note over Daemon: 7. 调用 containerd
    Daemon->>Containerd: CreateContainer(spec)
    Containerd->>ContainerdD: gRPC Create
    ContainerdD->>ContainerdD: 启动 shim 进程
    ContainerdD->>ContainerdD: 调用 runc create
    ContainerdD-->>Containerd: Task Handle
    
    Daemon->>Containerd: StartTask()
    Containerd->>ContainerdD: gRPC Start
    ContainerdD->>ContainerdD: runc start
    ContainerdD-->>Containerd: Task Running
    
    Note over Daemon: 8. 连接网络
    Daemon->>Network: ConnectEndpoint(container)
    Network-->>Daemon: 网络配置完成
    
    Note over Daemon: 9. 更新容器状态
    Daemon->>Container: State = Running
    Daemon->>Daemon: 触发容器启动事件
    
    Daemon-->>Router: 启动成功
    Router-->>API: 204 No Content
    API-->>CLI: 启动完成

{
  "data-root": "/var/lib/docker",
  "exec-root": "/var/run/docker",
  "storage-driver": "overlay2",
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "default-runtime": "runc",
  "runtimes": {
    "nvidia": {
      "path": "/usr/bin/nvidia-container-runtime"
    }
  },
  "max-concurrent-downloads": 3,
  "max-concurrent-uploads": 5,
  "debug": false,
  "experimental": false,
  "features": {
    "buildkit": true
  }
}

# 1. 拉取镜像
docker pull nginx:latest

# 2. 创建容器
docker create --name web -p 8080:80 nginx:latest

# 3. 启动容器
docker start web

# 4. 查看日志
docker logs -f web

# 5. 进入容器
docker exec -it web bash

# 6. 停止并删除
docker stop web
docker rm web

docker pull
  → POST /images/create?fromImage=nginx&tag=latest
    → ImageService.PullImage()
      → distribution.Pull()
        → Registry 拉取 manifest 和 layers
        → ContentStore 存储镜像层

docker create
  → POST /containers/create
    → Daemon.ContainerCreate()
      → 验证镜像存在
      → 分配容器 ID
      → 创建容器配置文件

docker start
  → POST /containers/web/start
    → Daemon.ContainerStart()
      → 生成 OCI Spec
      → Containerd.CreateContainer()
      → Containerd.StartTask()
      → Libnetwork.ConnectEndpoint()

FROM golang:1.20-alpine AS builder
WORKDIR /app
COPY . .
RUN go build -o /bin/myapp

FROM alpine:latest
COPY --from=builder /bin/myapp /usr/local/bin/
ENTRYPOINT ["myapp"]

docker build -t myapp:v1.0 .
  → POST /build
    → Builder.Build()
      → 解析 Dockerfile
      → 逐步执行指令（FROM/COPY/RUN）
      → 每步创建临时容器
      → 提交为新镜像层
      → 最终生成镜像 ID

docker run -d \
  --name prod-app \
  --memory=2g \
  --memory-swap=2g \
  --cpus=2.0 \
  --restart=unless-stopped \
  myapp:v1.0

HEALTHCHECK --interval=30s --timeout=3s --start-period=40s \
  CMD curl -f http://localhost:8080/health || exit 1

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "50m",
    "max-file": "5",
    "compress": "true"
  }
}

# 使用非特权用户
docker run --user 1000:1000 ...

# 禁用特权模式
docker run --security-opt=no-new-privileges ...

# 只读根文件系统
docker run --read-only --tmpfs /tmp ...

# 限制能力
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE ...

# 实时统计
docker stats --no-stream

# Prometheus 集成
docker run -p 9323:9323 \
  --name docker-exporter \
  google/cadvisor:latest