dockerd

dockerd is the Docker Engine daemon. Its main is intentionally tiny — almost all logic lives under daemon/.

Entry point

cmd/dockerd/main.go does five things:

1. reexec.Init() — give privileged helpers registered with github.com/moby/sys/reexec a chance to take over the process.
2. Ignore SIGPIPE (a workaround for journald restarts; references issue #19728 inline).
3. Resolve term.StdStreams so log output behaves on Windows consoles.
4. Construct a daemon/command.NewDaemonRunner.
5. Call r.Run(ctx).

Everything else — flag parsing, config loading, daemon construction, server startup, signal handling, graceful shutdown — happens inside daemon/command.

Startup pipeline

graph TD
  Main[cmd/dockerd/main.go] --> Reexec[reexec.Init]
  Main --> Runner[daemon/command.NewDaemonRunner]
  Runner --> Cobra[Cobra root command]
  Cobra --> LoadConfig[config.Load + flags]
  Cobra --> NewDaemon[daemon.NewDaemon]
  NewDaemon --> Img[ImageService init<br/>(legacy or containerd)]
  NewDaemon --> Net[libnetwork.NewController]
  NewDaemon --> Vol[volumes.New]
  NewDaemon --> Plug[plugin.Manager init]
  NewDaemon --> Builder[BuildKit + classic builder]
  NewDaemon --> Cluster[swarm cluster.Provider]
  Runner --> Server[daemon/server.New]
  Server --> Listeners[Unix socket / TCP / npipe]
  Server --> Routers[register routers]
  Server --> Serve[ListenAndServe]

The configuration object combines daemon/config/config.go with command-line flags. On reload (SIGHUP), only a subset of fields is honored; see daemon/reload.go.

Listeners

Listeners are created by daemon/listeners/ and wrapped by middleware before routes are mounted. Defaults:

• unix:///var/run/docker.sock (Linux)
• npipe:////./pipe/docker_engine (Windows)
• Optionally TCP with TLS, configured via --host flags or daemon.json.

The HTTP server itself lives in daemon/server/server.go; it mounts every router twice (with and without /v{version}/ prefix) so both versioned and unversioned clients work.

Subsystems wired by Daemon

The Daemon god-object in daemon/daemon.go holds references to:

• Container store (container.Store, container.ViewDB).
• An ImageService (containerd-backed or graphdriver-backed).
• libnetwork.Controller for networking.
• volumesservice.VolumesService for volumes.
• plugin.Manager and the legacy plugin.Store.
• events.Events for the event bus.
• stats.Collector for container stats.
• The swarm cluster.Provider and Cluster interface.

See the per-subsystem deep dives under Systems.

Graceful shutdown

Daemon.Shutdown (in daemon/daemon.go) tears subsystems down in order: stop accepting new requests, drain in-flight tasks, stop the cluster, close the network controller, sync the image store. The HTTP server reuses Go's http.Server.Shutdown semantics; long-lived hijacked connections (attach, exec) are interrupted.

Reexec helpers

Several daemon code paths register reexec entry points so the binary can re-spawn itself with elevated or namespaced privileges. Search the codebase for reexec.Register to find them — examples include docker-init-style entries in graphdrivers and rootless mode.

Build inputs

dockerd is built by make binary / make dynbinary via docker-bake.hcl. Build tags toggle features (e.g. seccomp, apparmor, journald); the tag set used in releases is set in Dockerfile.

See also

• Architecture for the data-flow picture.
• API for the HTTP surface.
• Daemon core for the Daemon struct in detail.