Checkpoint Lab — Docker Engine Components: dockerd, containerd, runc, BuildKit, APIs, and Container Lifecycle

1. Checkpoint outcome and safety envelope

You will produce one evidence packet that connects a BuildKit build to an Engine image object and then to a container object's runtime process and event timeline. The checkpoint is intentionally local and disposable: no registry push, no external secrets, no privileged container, no socket mount, no daemon reconfiguration, and no broad prune.

2. Preflight and assumptions record

set -eu
LAB=da-ch03-checkpoint
IMAGE=da-ch03-checkpoint:local
LABEL='devops-academy.lab=chapter03-checkpoint'
WORK="${TMPDIR:-/tmp}/da-ch03-checkpoint"
EVIDENCE="$WORK/evidence"
mkdir -p "$EVIDENCE"

date -u | tee "$EVIDENCE/00-time.txt"
docker context show | tee "$EVIDENCE/01-context.txt"
docker version | tee "$EVIDENCE/02-version.txt"
docker info | tee "$EVIDENCE/03-info.txt"
docker buildx version | tee "$EVIDENCE/04-buildx-version.txt"
docker buildx ls | tee "$EVIDENCE/05-builders.txt"
docker buildx inspect --bootstrap | tee "$EVIDENCE/06-builder-inspect.txt"

Prediction 1: the build will create BuildKit progress evidence and, because --load is used, a local Engine image object. Prediction 2: docker create will create a container object with no running PID; docker start will then create a running task/process.

3. Create the bounded build input

cat > "$WORK/Dockerfile" <<'EOF'
FROM busybox:1.36.1
RUN printf 'chapter03-checkpoint\n' > /evidence.txt
CMD ["sh", "-c", "echo runtime-pid1=$$; cat /evidence.txt; trap 'echo TERM-received; exit 0' TERM; while :; do sleep 5; done"]
EOF
sha256sum "$WORK/Dockerfile" | tee "$EVIDENCE/07-dockerfile-sha256.txt"
docker pull busybox:1.36.1 | tee "$EVIDENCE/08-base-pull.txt"
docker image inspect busybox:1.36.1 --format 'ID={{.Id}} RepoDigests={{json .RepoDigests}}' | tee "$EVIDENCE/09-base-image.txt"

4. Build and prove the output contract

START=$(date -u +%Y-%m-%dT%H:%M:%SZ)
docker buildx build --progress=plain --load   --label "$LABEL"   -t "$IMAGE" "$WORK" 2>&1 | tee "$EVIDENCE/10-build.log"

docker image inspect "$IMAGE"   --format 'ID={{.Id}} Created={{.Created}} Labels={{json .Config.Labels}}'   | tee "$EVIDENCE/11-image.txt"

Do not call this a registry digest: a locally built image can have an image/config ID without a registry RepoDigest. The checkpoint records exactly the identity it can prove.

5. Create, inspect, and start the container

docker create --name "$LAB" --label "$LABEL" "$IMAGE"   | tee "$EVIDENCE/12-container-id.txt"
docker inspect "$LAB" --format 'Status={{.State.Status}} PID={{.State.Pid}} Image={{.Image}}'   | tee "$EVIDENCE/13-created-state.txt"

docker start "$LAB" | tee "$EVIDENCE/14-start.txt"
sleep 1
PID=$(docker inspect -f '{{.State.Pid}}' "$LAB")
docker inspect "$LAB" > "$EVIDENCE/15-running-inspect.json"
docker logs "$LAB" > "$EVIDENCE/16-container.log" 2>&1
printf 'Docker-reported PID=%s
' "$PID" | tee "$EVIDENCE/17-pid.txt"

If you are on native Linux Engine, optionally add read-only host correlation. On Docker Desktop, state that the PID lives inside the managed Linux VM boundary.

ps -fp "$PID" > "$EVIDENCE/18-host-process.txt" 2>&1 || true
ls -l "/proc/$PID/ns" > "$EVIDENCE/19-namespaces.txt" 2>&1 || true
cat "/proc/$PID/cgroup" > "$EVIDENCE/20-cgroup.txt" 2>&1 || true
ps -eo pid,ppid,comm,args | grep '[c]ontainerd-shim' > "$EVIDENCE/21-shims.txt" 2>&1 || true

6. Stop, capture events, and preserve exit evidence

docker stop --time 10 "$LAB" | tee "$EVIDENCE/22-stop.txt"
END=$(date -u +%Y-%m-%dT%H:%M:%SZ)
docker events --since "$START" --until "$END" --filter "container=$LAB"   > "$EVIDENCE/23-events.txt"
docker inspect "$LAB" \
  --format 'Status={{.State.Status}} Exit={{.State.ExitCode}} Started={{.State.StartedAt}} Finished={{.State.FinishedAt}}'   | tee "$EVIDENCE/24-final-state.txt"

7. Record runtime component evidence where the platform exposes it

(containerd --version || true) > "$EVIDENCE/25-containerd.txt" 2>&1
(runc --version || true) > "$EVIDENCE/26-runc.txt" 2>&1
(systemctl status docker --no-pager || true) > "$EVIDENCE/27-docker-service.txt" 2>&1
(journalctl -u docker --since "$START" --no-pager || true) > "$EVIDENCE/28-daemon-log.txt" 2>&1

On Docker Desktop, several host-level files can correctly say “command not available” or show no service manager. That is a documented limitation, not a reason to enter the VM or weaken Desktop boundaries for this checkpoint.

8. Evidence review: what each success proves

9. Guarded cleanup and proof

docker rm "$LAB"
docker image rm "$IMAGE"

docker ps -a --filter "label=$LABEL" | tee "$EVIDENCE/29-post-cleanup-containers.txt"
docker images --filter "label=$LABEL" | tee "$EVIDENCE/30-post-cleanup-images.txt"

tar -C "$WORK" -czf "$WORK/chapter03-evidence.tgz" evidence
printf 'Evidence archive: %s
' "$WORK/chapter03-evidence.tgz"

10. Operational review and Chapter 04 handoff

You can now localize a Docker operation across client/API, dockerd, Docker-managed containerd, shim/runc, kernel process, and BuildKit builder state. Chapter 04 takes the image identity captured here and decomposes it into content-addressable layers, configuration objects, manifests/indexes, tags, image IDs, and digests.

Knowledge check

Official references and version notes

• Docker architecture overview — client/server ownership and the daemon's responsibility for Docker objects.
• Docker Engine API — API negotiation and the current Engine/API compatibility matrix.
• Docker Engine 29 release notes — current Engine 29 packaging, component, security, and compatibility changes.
• Alternative container runtimes — Docker Engine's use of containerd for container lifecycle and runc as the default OCI runtime.
• containerd image store with Docker Engine — current Engine 29 storage architecture and upgrade/fresh-install differences.
• Run containerd in the Docker daemon — current experimental embedded-containerd boundary introduced in Engine 29.7.
• BuildKit — Docker's modern build backend and its graph/cache model.
• Builders — default and custom BuildKit builder ownership.
• Docker build driver — integrated BuildKit behavior and local-image loading.
• Docker-container build driver — isolated, configurable BuildKit builder behavior and output semantics.
• Live restore — daemon-unavailability behavior, scope, caveats, and upgrade constraints.
• docker system events — event-stream evidence for object lifecycle transitions.