Privacy Tool Spotlight: Docker
Have you ever seen one of those mega cruise ships in person? The word "impressive" hardly does them justice. We had the entire crew, all the cats and kittens from each of our clowders, in Port Canaveral for a team cruise vacation. Everyone arrived the day before to avoid any last-minute issues, and when we walked out of the hotel the morning of the cruise it looked like the cruise ship was docked right next to us. It wasn’t. The ship sat more than a mile away. Its sheer size created the same optical illusion you get in Las Vegas, where the massive hotels appear only a block or two away when they are actually much farther.
What’s even more impressive is watching one of these ships come together in record time on those mega-build shows. For comparison, the RMS Titanic, with a passenger and crew capacity of 3,327, took three years to complete. Modern mega resort-style ships with all of their activity and dining options that hold roughly three times as many people (about 9,950 passengers and crew) are finished in just over two years. This speed is possible thanks to modular construction techniques that let specialized teams build large sections of the ship in their own workshops.
Think about the thousands of cabins required for a vessel that size. They are not built on the ship itself. Instead they are outsourced to factories that specialize in nothing but cabins. These are not empty metal shells. Every cabin arrives fully finished and ready to go: hallway door, complete bathroom, furniture, carpets, lights, wiring, and plumbing, all pre-installed and tested. Once complete, the cabins travel to the shipyard, are lifted onto the correct deck, slid into position, and given their final connections to the ship’s power, water, and other systems. In short order they are ready for their first passengers.
If you have been reading about privacy, you have almost certainly come across the terms Docker and containers. The idea behind them is not that different from the process of creating, delivering, and installing those ready-to-go cabins on a cruise ship. Let’s dive into it.
Overview of Docker
The usual explanation goes something like this: Docker is an open-source platform that packages applications with everything they need so they can run the same way everywhere. That definition is accurate, yet it says a lot without really explaining much to the rest of us.
Here’s the simpler version. In the past you downloaded software made for one specific operating system, then clicked through a long series of installation screens. Docker changes that. It uses ready-made application packages (called images) that already contain everything the program needs. Those packages work the same way on nearly every platform Docker supports, so millions of people can run the exact same application without the usual headaches. Let’s look at how the pieces fit together, starting from the bottom up.
1. Docker Images
Think of Docker Images as those pre-made cruise cabins. Everything the application needs is already installed and configured: the code, the tools it relies on, and the settings that make it work. An image is basically a complete snapshot or blueprint. When something in the application changes, Docker only has to update the part that actually changed. Most people pull these ready-to-use images from a public library called Docker Hub, so you can start with a fully prepared environment in seconds.
2. Docker Compose
Think of Docker Compose as the detailed installation blueprints for those cabins. It tells Docker exactly where every piece goes and how it connects to the rest of the ship (or in this case, your computer). Instead of starting each part of an application by hand, you write one simple configuration file (usually named docker-compose.yml). That single file acts as the master plan. With one command you can launch a whole set of related applications. Compose handles the connections, storage, and networking so everything talks to each other smoothly.
3. Docker Containers
Once a cabin is installed and hooked up to the ship’s systems, it becomes a living, usable space. A Docker Container works the same way: it is a running, active version of a Docker Image. If the image is the blueprint, the container is the actual cabin with passengers inside. Containers stay separate from each other and from the rest of your computer, yet they stay lightweight because they share the computer’s core operating system. You can start them, stop them, move them, or remove them without touching the original image. This is where the application actually runs and does its work.
4. Docker Engine
This is the crew that installs the cabins and keeps them running. The Docker Engine is the core of the whole system. It builds the images, starts the containers, and manages everything behind the scenes. When you type a simple command, the Engine receives it, figures out what resources are needed, and tells your computer how to handle the containers from start to finish. In practice that means it can start this container, stop that one, or check how much space each is using, all without you having to dig into the details.
The Benefits
Just as a cabin can be swapped out without remodeling the entire ship, the advantages of Docker start with the containers themselves. You can download an image, create a new container, and try out different tools without making any permanent changes to your computer. More than once we have downloaded an image only to discover it did not meet our needs. A simple command like docker rm <container-name> removes it completely, as if it had never been there.
The same flexibility applies to updates. If you download an image tagged with :latest, Docker will always pull the newest version available. On the other hand, if that newest version does not work the way you expect, you can simply switch to a specific earlier version that you know is reliable. This approach makes managing applications far easier for everyone.
We can also give each container a permanent place to keep its data. The two most common options are creating a Docker volume with a command like docker volume create <volume-name> (Docker manages this storage for you) or pointing the container to a regular folder on your computer. Think of the volume or the folder as the personal belongings passengers keep in their cabin; when the cabin itself is replaced, the belongings stay put. This step matters because updating an image wipes out and replaces everything inside the container. By storing the data in a separate location, your information stays safe and intact while the application itself gets upgraded.
How Docker Strengthens Privacy
The same modular design that makes cruise-ship cabins easy to install and replace also creates real privacy advantages.
Docker Images limit hidden extras. Traditional software installers often ask for broad permissions or quietly add background services that watch what you do. Because open-source Docker images are built from clear, readable recipes (called Dockerfiles), trusted maintainers include only what the application needs to run. That reduces the chance of bundled tracking tools or unwanted background monitors.
Docker Containers act as digital sandboxes. One of Docker’s biggest privacy strengths is separation. An application running inside a container stays isolated from your main computer by default. It cannot see your personal Documents folder, your browser history, or other software unless you specifically allow it. If you want to try a new privacy tool without giving it full access to your hard drive, a container keeps it neatly confined, just like one cabin on the ship stays separate from the rest.
Docker Compose prevents unwanted cross-talk. Compose lets you decide exactly how applications talk to one another. You can set up private internal networks so your self-hosted tools (such as a password manager or private cloud storage) communicate safely in their own isolated space, completely cut off from other programs on your machine.
Clean removal leaves no leftovers. Uninstalling ordinary desktop software often leaves behind stray files, hidden tracking data, and scattered remnants. With Docker, deleting a container and its image removes the entire environment cleanly. No leftover logs, no persistent tracking files, just a clean slate.
Docker does not make an application automatically secure by itself, but it gives you clear control over the boundaries. By turning programs into self-contained, easily disposable units, you can run useful tools on your own hardware without handing over control of your personal data.
How Docker’s Core Tools Handle Telemetry
A common question is whether Docker’s main tools secretly collect and send data back to central servers. The short answer: Docker's core engine is telemetry-free, though Docker Desktop adds opt-out options.
- Docker Engine runs strictly as a local background process (
dockerd) on your computer. It handles commands, builds images, and manages containers locally without sending information about your setup. - Docker Images and Docker Compose files (
docker-compose.yml) are simple blueprint files stored entirely on your hard drive. - Docker Containers are temporary local spaces created by the Engine.
Because the core Engine is open-source, none of these components collect usage metrics or report what software you choose to run. They only use the network when you deliberately issue a remote command, such as docker pull to download an image from Docker Hub.
If you use Docker Desktop, the graphical interface for macOS and Windows, it does include an optional feature that sends anonymous usage data and crash reports by default. This belongs to the optional desktop app, not the core Docker Engine, and can be turned off completely in Settings > General.
Where Can You Use Docker?
The short answer is just about anywhere. From the tiny Raspberry Pi running Home Assistant, to your laptop or desktop, to even your network attached storage (NAS) like those from Synology or UGREEN. The strength in Docker is its ability to work just about anywhere. Of course that doesn't mean every platform is appropriate for the containers you might load.
A great example is Ollama the local AI solution. We use Docker to manage the image because it's updated almost weekly with various improvements. Does that mean it should be run anywhere it can be installed? Well, we've installed it on a Raspberry Pi 5 with 16GB and on our home server with a GPU sporting 16GB of VRAM. We actually were able to get Ollama running on the Raspberry Pi 5 with a small model. It wasn't blazing fast, or even could be considered quick, but it worked. In contrast, the server with an available GPU performed much more in-line with our expectations.
Another solution, such as Jellyfin requires far less resources and performes quite well on our old Synology DiskStation, streaming content that's stored on the DiskStation. In some cases, it becomes an 'it depends' answer.
We're hosting Wikipedia offline via a Kiwix image. Resource wise, Kiwix is a rock star with storage being the larger concern. Wikipedia without images is a 42GB file. So, while it was running well on the same server Ollama was hosted on, it felt like hosting it on the DiskStation would make more sense because it's nothing but storage. We loaded up the image, pointed it to the location of Wikipedia, and it responded quickly. Where performance started to fall apart was when we used the search capability in Kiwix. So, while both the server and DiskStation hosted Kiwix without issue, the server had more available resources to ensure the performance of the search capability.
What Applications Can You Host?
The list is endless! Maybe you'd like to host Jellyfin, Ollama, Kiwix, or even Home Assistant that we've spoken about. Or you'd like to host your Bitwarden locally with Vaultwarden. As we spoke about in Escape the Silo: Hot, Warm & Cold Privacy Resilience both Ente and Notesnook allow you to host locally using Docker images. In short, you have the option to host so many things locally you may run out of resources, especially when the requirements can be low. That's when you have to decide what's right for your bespoke solution.
Wrap Up
We set out to demystify Docker and show why it has become such a popular tool, especially among people who care about privacy. Just as modular cabins transformed how giant cruise ships are built, containers change how we install, run, and remove software. Everything arrives ready to go, stays neatly separated from the rest of the system, and can be replaced or removed without leaving a mess behind.
That combination of isolation, control, and clean cleanup is what makes Docker especially useful for privacy-minded users. You can try new tools safely, keep sensitive applications in their own spaces, and decide exactly what data stays on your machine. Whether you are running a media server, a local password manager, an offline knowledge base, or something entirely new, the same approach applies.
Docker will not solve every privacy challenge on its own, but it hands you the tools to keep more of your digital life under your own roof and on your own terms. The next time you see a privacy tool offered as a Docker image, you will know exactly what that means and why it can be a smarter, cleaner way to run it.
Remember: We may not have anything to hide, but everything to protect.
