Docker Engine is the core runtime that creates, starts, stops, and isolates containers on a host. It includes the daemon, APIs, and supporting components that manage images, networks, volumes, and container lifecycles. In practice, it is the control plane that turns a container image into a running service.
It matters in cyber security because Docker Engine often sits on the path between workloads and sensitive resources such as registries, credentials, and internal networks. If the engine mishandles input, network resolution, or privilege boundaries, an attacker may be able to intercept traffic, alter image delivery, or abuse management APIs to escape normal trust assumptions. Defenders reduce risk by patching quickly, limiting daemon exposure, enforcing least privilege, validating image provenance, and hardening DNS and registry settings.