What happens internally when you run `docker run nginx`?

The CLI sends a create-container request to the daemon. The daemon checks for the image locally, pulling from the registry if missing. It asks containerd to create a container from the image's layered filesystem (via the storage driver) plus a new writable layer. containerd asks runc to set up namespaces and cgroups and exec the container's entrypoint. The daemon then configures networking (bridge attachment, NAT rules for any -p mappings) before returning control to the CLI.