What is Docker & Why Bioinformaticians Need It

01 The reproducibility crisis in bioinformatics

Imagine this scenario: you spend three months building an RNA-seq pipeline to analyse your sorghum transcriptome data. It runs perfectly on your Ubuntu machine in Gießen. You send the scripts to a collaborator in Tokyo. They run the exact same code and get different results — or the pipeline crashes entirely.

This is not a hypothetical. It is one of the most documented problems in computational biology. A 2016 survey found that more than 70% of researchers had failed to reproduce another scientist's results. In bioinformatics specifically, the problem is acute because a single pipeline depends on dozens of interlocking software versions.

The traditional solutions each have serious problems:

Docker is the answer the bioinformatics community has converged on. Journals like Nature Methods and Bioinformatics increasingly expect that published pipelines ship with a Dockerfile. Workflow frameworks like Nextflow and Snakemake have built-in Docker support. Learning Docker is not optional for a modern bioinformatician — it is foundational.

02 Virtual machines vs containers — what is the actual difference?

To understand Docker, you need to understand what it replaced and why it is fundamentally different — not just faster, but architecturally different.

Virtual machines (VMs): simulating entire hardware

A virtual machine uses a piece of software called a hypervisor (e.g. VirtualBox, VMware, KVM) to simulate a complete physical computer inside your real computer. When you run a VM, you are running a fake CPU, fake RAM, fake hard disk — all simulated. On top of that fake hardware, you install a complete operating system (the "guest OS"), and on top of that, your actual software.

Containers: sharing the host kernel

A container takes a completely different approach. Instead of simulating hardware, it uses Linux kernel features — specifically namespaces and cgroups — to create isolated environments that share the host machine's kernel directly.

Namespaces isolate what a process can see: its own filesystem, its own network, its own process list — even though the host kernel is running everything. Cgroups limit what a process can use: CPU time, RAM, disk I/O. Together, they create the illusion of an isolated machine without actually simulating one.

03 Core Docker concepts — the vocabulary you must know

Docker has a small vocabulary of terms that are used precisely and consistently everywhere. Confusing "image" with "container" is the most common beginner mistake. Here is what each term means:

04 How Docker is actually used in bioinformatics today

Docker is not just a theoretical tool — it is baked into the infrastructure of modern bioinformatics at every level. Here is where you will encounter it in real research workflows:

1. Biocontainers: one image per tool

The Biocontainers project (biocontainers.pro) automatically builds a Docker image for every package in Bioconda. This means that instead of installing STAR, samtools, GATK, and FastQC manually, you can run each tool from its own pre-built, version-pinned container with a single docker pull command.

# Pull a specific version of STAR from Biocontainers
docker pull quay.io/biocontainers/star:2.7.11b--h43eeafb_0

# Pull samtools 1.18
docker pull quay.io/biocontainers/samtools:1.18--hd87286a_0

# Pull FastQC
docker pull quay.io/biocontainers/fastqc:0.12.1--hdfd78af_0

2. Nextflow and Snakemake native Docker support

Both major workflow managers in bioinformatics support Docker natively. In Nextflow, you specify a Docker image per process and Nextflow automatically pulls it and runs each step inside the container. Your pipeline becomes entirely self-contained — collaborators just need Nextflow and Docker installed.

// nextflow.config — Docker enabled globally
docker.enabled = true

// main.nf — each process specifies its own image
process STAR_ALIGN {
    container 'quay.io/biocontainers/star:2.7.11b--h43eeafb_0'

    input:
      path reads
      path genome_index

    output:
      path "*.bam"

    script:
    """
    STAR --runThreadN 8 \
         --genomeDir ${genome_index} \
         --readFilesIn ${reads} \
         --outSAMtype BAM SortedByCoordinate
    """
}

3. HPC clusters via Singularity / Apptainer

Most HPC clusters (like those at JLU Gießen or GWDG) do not allow Docker itself because it requires root privileges. Instead, they use Singularity (now called Apptainer), which can directly convert Docker images to Singularity format. This means you build and test with Docker locally, then run the exact same image on the cluster via Singularity — no root needed.

# On the HPC cluster — convert Docker image to Singularity .sif file
singularity pull --name star.sif \
    docker://quay.io/biocontainers/star:2.7.11b--h43eeafb_0

# Run STAR inside the Singularity container
singularity exec star.sif \
    STAR --runThreadN 8 \
         --genomeDir /data/sorghum_genome/ \
         --readFilesIn sample1_R1.fastq.gz sample1_R2.fastq.gz

4. Galaxy, CWL, and cloud platforms

The Galaxy platform (usegalaxy.org) runs every tool inside a Docker container. The Common Workflow Language (CWL) standard — used to describe portable bioinformatics workflows — uses Docker images to specify tool environments. AWS, Google Cloud, and Azure all support Docker-based batch computing for large genomics jobs.

05 Docker's architecture — what happens when you type docker run

When you type docker run ubuntu:22.04 bash, a surprisingly sophisticated sequence of events happens in milliseconds. Understanding this sequence prevents confusion when things go wrong.

The key architecture components are:

What gets isolated and what does not

Containers are isolated but not fully sandboxed like VMs. This matters for security and for understanding what your pipeline can and cannot access:

06 Knowledge check exercises

These are conceptual exercises for Lesson 1 — no terminal needed yet. Lesson 2 is where you install Docker and run your first container.