How a Single 'docker run' Command Triggers a Four-Layer Execution Chain

Running 'docker run' initiates a chain involving four separate programs before a container process is created. The Docker CLI converts the command into an HTTP request sent to the Docker daemon, which checks for the required image and downloads only missing layers. The daemon then delegates container lifecycle management to containerd, which unpacks image layers using overlayfs and assembles an OCI bundle containing a runtime spec and root filesystem. Finally, runc reads that spec, makes Linux kernel calls to create namespaces and cgroups, pivots the root filesystem, drops unnecessary capabilities, and executes the target process. Each step is observable on a real machine, and none of it involves magic — just a well-defined handoff between standard Linux tools.