Walk through what happens when you run docker run -d -p 8080:80 nginx on a machine that has never pulled nginx.

The CLI asks the Docker daemon for the image, the daemon pulls it, creates a container, sets up networking, and starts the process. Step by step:

1. CLI to daemon. The docker CLI sends the request to the Docker daemon (dockerd) through its API. The daemon is the background service that does the real work.
2. Pull the image. The daemon looks for the nginx:latest image locally and does not find it. So it pulls the image layers from the configured registry. By default this is Docker Hub.
3. Create the container. The daemon adds a new writable layer on top of the image layers. It also stores the container's configuration.
4. Set up networking. The daemon:

• creates a network interface
• attaches the container to the default bridge network
• gives the container an IP address
• maps host port 8080 to container port 80

5. Start the process. The daemon asks the runtime (containerd and runc) to start the process from the image's ENTRYPOINT and CMD. The process runs inside new namespaces and cgroups.

Because of -d (detached), the CLI prints the container ID and returns. It does not attach to the container's output.