World map

 

BM: Baca dalam Bahasa Melayu

World D6: Under the Hood

A container is just a process

You will learn: that a running container is a normal Linux process, and how to see it from both sides.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

You run ps aux on your Linux laptop. One line says nginx: master process. But you never installed nginx! Where did it come from?

Pick one answer.

Watch

docker top lists the nginx processes in web. Then ps aux on the laptop lists the same PID numbers, under a containerd-shim line. Docker transcript: $ docker top web UID PID PPID C STIME TTY TIME CMD root 8146 8113 0 09:00 ? 00:00:00 nginx: master process nginx -g daemon off; 101 8193 8146 0 09:00 ? 00:00:00 nginx: worker process 101 8194 8146 0 09:00 ? 00:00:00 nginx: worker process 101 8195 8146 0 09:00 ? 00:00:00 nginx: worker process 101 8196 8146 0 09:00 ? 00:00:00 nginx: worker process $ ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 22576 13204 ? Ss 09:00 0:01 /sbin/init root 812 0.1 0.4 2433024 71236 ? Ssl 09:00 0:03 /usr/bin/containerd root 1044 0.1 0.6 3354372 98472 ? Ssl 09:00 0:04 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock you 2201 0.0 0.0 11292 5376 pts/0 Ss 09:00 0:00 -bash root 8113 0.0 0.0 1238004 13056 ? Sl 09:00 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 4acac0af2c1c0ae8bf27f30dd50c53cb17766653ab4e971063d2888fd59ceeb5 -address /run/containerd/containerd.sock root 8146 0.0 0.0 9876 6012 ? Ss 09:00 0:00 nginx: master process nginx -g daemon off; 101 8193 0.0 0.0 9876 6012 ? S 09:00 0:00 nginx: worker process 101 8194 0.0 0.0 9876 6012 ? S 09:00 0:00 nginx: worker process 101 8195 0.0 0.0 9876 6012 ? S 09:00 0:00 nginx: worker process 101 8196 0.0 0.0 9876 6012 ? S 09:00 0:00 nginx: worker process you 8198 0.0 0.0 13840 4608 pts/0 R+ 09:00 0:00 ps aux

Your laptop~

  • Laptop port 8080 → web port 80

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

1 containers (1 running), 1 images, 0 lockers.

docker top web asks Docker what runs in the lunchbox. ps aux asks the laptop. The PIDs match! The lunchbox is a normal process wearing blinkers.

Try it

Now look from inside the lunchbox. Type docker exec web ps.

Your laptop~

  • Laptop port 8080 → web port 80

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

1 containers (1 running), 1 images, 0 lockers.

Predict

Inside, nginx is PID 1. On the laptop, it has a big PID. How many nginx masters are running?

Pick one answer.

Watch

uname -r prints the same Linux kernel version on the laptop and inside web. Docker transcript: $ uname -r 6.18.44-fc-v185 $ docker exec web uname -r 6.18.44-fc-v185

Your laptop~

  • Laptop port 8080 → web port 80

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

1 containers (1 running), 1 images, 0 lockers.

Both print the same kernel: The kitchen's one stove: the core of Linux. Every container on a machine cooks on the same kernel. version. The kernel is the kitchen’s one stove. Every lunchbox cooks on the laptop’s stove.

Check

Which ones are true for a container? Which ones fit a virtual machine?

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now show that a container is a process on your laptop.

      Go deeper (optional)

      On a Mac or Windows PC with Docker Desktop, ps won’t show nginx. It runs inside a small Linux VM (lesson 7).

      Real rep (optional, Linux): see one process from both sides.

      Real mission

      1. docker run -d --name web nginx:1.30-alpine
      2. docker top web
      3. ps -ef | grep nginx
      4. docker rm -f web

      0 of 4 steps done · Your ticks are saved.