What happens when you run `docker run`?

The client sends a request to the daemon, which checks if the image exists locally (pulling it from a registry if not), creates a new container filesystem from the image's layers plus a new writable layer, sets up namespaces/cgroups, and starts the specified process as PID 1 inside the container.