Installation and Configuration
Client, daemon, config file
Docker is a CLI client (docker) talking to a daemon (dockerd). The daemon reads /etc/docker/daemon.json at startup. On systemd hosts, systemctl reload docker sends SIGHUP and applies only a subset (labels, insecure registries, mirrors, debug); most options need a full restart. A JSON syntax error stops the daemon entirely and takes every container on the host with it, so validate first.
Common keys: data-root (where images, containers, and volumes live - migrate the data before changing it), log-driver plus log-opts ({"max-size":"10m","max-file":"3"}), storage-driver (overlay2), insecure-registries, registry-mirrors, bip and default-address-pools for subnet control, live-restore to keep containers running across daemon restarts, userns-remap, and the tls, tlscacert, tlscert, tlskey family that secures the remote API.
Remote access: docker -H tcp://host:2376 --tlsverify ... or the DOCKER_HOST variable. Contexts (docker context create/use/ls) bundle endpoint plus TLS material and are the modern way to switch engines.
Traps
Option names are exact camelCase - a misspelled key is ignored or fatal. A log-driver change applies only to newly created containers. docker info shows effective daemon settings; docker version shows both client and server, and a missing Server block means the daemon is unreachable. Rootless mode runs dockerd inside a user namespace: no privileged ports, nonstandard socket path.
Rule of thumb
Before restarting, run dockerd --validate --config-file /etc/docker/daemon.json instead of guessing.