The parts that outlived the product: ten years of Docker, read from its own repositories

A decade of one company's architecture told through the sequence every platform team eventually faces: bundle to win the workflow, extract components to cut the blast radius of your own releases, specify the boundary so others can implement it, then lose the layer to the consumer that standardised it. A reader leaves with a decision tree for whether a component should leave the product, the three seam classes that decomposition creates and the incidents each produced, and a set of git commands that turn any dependency's repository into the same kind of evidence.

What you get out of it

• The components that survived the decade are the two that stopped changing: the OCI image specification went from 642 commits in 2016 to 8 in 2020 and waited six years and seven months for its next release, and that stillness is what let the implementations on both sides be replaced.
• Activity inverted: the engine fell from 10,133 commits in 2016 to 1,065 in 2021 while containerd, the piece it donated, held between 1,355 and 3,152 commits a year for ten years and now lists 26 production adopters, with the Docker engine as one entry among them.
• Decomposition relocates defects into seams, and the most expensive seam was procedural: a security fix that lived on one branch line for six years, verifiable with git tag --contains.
• Deferring a feature across a component boundary is a decision to drop it: checkpoint and restore was deferred to containerd in February 2016 and closed unmerged in March 2024, eight years and nine months later.
• The layer that kept its position is the one nobody found interesting: the registry, now metered at 100 pulls per six hours for anonymous users while single official images take over twenty million pulls a week.

Scope

Why this, now. The loop closed in 2025 and 2026: containerd became the engine's default image store in the v29 line, libnetwork was folded back into the daemon tree, an embedded containerd mode appeared, and the Go module path finally moved eight years after the repository did.

What it does not cover. Docker Desktop's internals, Windows containers, Kubernetes' own architecture and Docker Inc.'s finances; and, because the session's egress policy allowed only six hosts, it contains no engineering-blog, conference-talk or academic-paper evidence at all.