Docker vs Kubernetes: One Runs a Box, One Runs the Fleet

0:00Three in the Morning

Last time, we opened the box and found nothing inside — a container is just an ordinary process your kernel tells stories to. Here's the next problem. It's three in the morning, and one of those processes just died. Docker did exactly what you asked. You said: run this container — and it ran it. Nobody ever asked it to watch. So the question that actually separates Docker from Kubernetes isn't which one is better. One of them runs a box. What runs the fleet? The answer is a machine that never sleeps — built on one idea simple enough to hang on your wall.

0:40Docker's Job Description

Be fair to Docker — its job description is short. Build an image. Run a container. On this machine. It does that perfectly, and nothing in it promises anything else. Now count what you're actually running: an API, a database, a queue — several copies of each, spread across many machines. When a container dies over there, who notices? When a whole machine dies, who moves its work? When traffic triples, who starts more copies — and who tells the network where they went? Every one of those jobs lands on a human with a pager. That gap has a name — orchestration — and it is the entire reason Kubernetes exists.

1:25The Thermostat

Kubernetes starts by changing the sentence you speak. You never say: start a container. You write down a fact you want to be true — three copies of this app exist — and hand it over. That's called desired state. And the mechanism that acts on it is older than software: a control loop. The same idea as a thermostat. You set the temperature you want; the room disagrees; the machine works to close the gap. Kubernetes runs loops like that all day, forever. Each controller watches the cluster and — in the documentation's own words — tries to move the current state closer to the desired state. That is the whole idea. You declare; the loop reconciles. Everything else in Kubernetes is plumbing in service of that one sentence.

2:24The Machine Room

So here's the machine room. A cluster is a control plane plus worker machines, called nodes. Everything you declare goes through one front door — the API server — and is written into a ledger called etcd, the store where the cluster keeps all its records, your declaration included. The scheduler watches for work that has no home yet and picks a node for it. The controller manager runs those reconciliation loops. And down on every node, an agent called the kubelet takes what the ledger says and makes sure the right containers are actually running — grouped into pods, the smallest unit Kubernetes deals in: one or more containers sharing storage and a network address. Notice what the containers themselves are doing: exactly what they did under Docker. Nothing about the box changed. What changed is who is watching it.

3:29Three A.M., Replayed

Now replay three in the morning. A container dies. The kubelet's report no longer matches the ledger. The ledger says three. The world says two. No alarm rings, because no alarm is needed — the loop notices the gap and starts a replacement. That's self-healing: restart what fails, replace what dies, and don't send traffic to a copy until it's ready. Scaling is the same move in the other direction: change the three to a thirty, and the loop does the rest. Lose an entire machine, and its pods are rescheduled onto the machines that remain. The human is still asleep. Nothing woke up — because the loop never went to sleep.

4:21Don't Panic

Which brings us to the headline. December twenty-twenty: Kubernetes announces it is deprecating Docker. The internet panicked — and nothing broke. Because inside a cluster, Kubernetes never needed Docker's friendly wrapping — the command line, the build tools. It needed the engine underneath — a runtime called containerd — and had been reaching through a translation shim to get at that engine. Dropping the shim changed nothing about your images. Containers you build with Docker run in every cluster, exactly as they always have. So the rivalry was never real. Docker builds the box, and runs it on your desk. Kubernetes runs the fleet. They meet at the image. Google ran its systems this way for more than a decade before open-sourcing Kubernetes — and named it with the Greek word for helmsman. Not the engine. Not the cargo. The one who steers.