Composer is an application package manager. It is an application that needs to be installed on your local machine. When used, it gathers, installs, and autoloads into the framework all the various dependencies required to operate the site (such as libraries, the Magento core codebase, and other frameworks required to operate a Magento 2 site). You can also use it to manage your own modules/themes as packages if desired.
Once installed, it can be run in the command-line in any directory that contains a valid composer.json or composer.lock file. In the Magento 2 codebase these files are located in docroot.
There are two composer commands in common use.
composer install and
composer update. The command
composer update will read the composer.json file and go through each item in it and check the various remote packages (you'll need some keys to access repo.magento.com (the place online where magento 2 core code packages are hosted), these can be obtained via a free Magento account).
If everything checks out, the
composer update command will create a new file composer.lock. This file contains a snapshot of all the various packages along with their version numbers that have been installed by
composer update. It it recommended to submit the lock file into version control.
If a composer.lock file is present, you can run
composer install and it'll just read the lock file and install from there. This can help as if minor updates are issues to packages, developers can be using slightly different versions of packages depending on when they ran
composer update. If a lock file is present and each developer runs
composer install they'll be using the same package versions.
In summary, go to Magento 2 docroot and look for a composer.lock file. If it's there just run
composer install (and enter keys if/when prompted). If it's not there then run
composer update and then don't forget to submit the new composer.lock file to your version control system.
Once composer has downloaded and installed all the packages, you will have a vendor folder in your docroot. This contains all framework dependencies and the core Magento 2 codebase. If you're using composer, your app/code folder should only contain new modules not part of the Magento 2 core framework.
Now when it comes time to upgrade Magento, because everything is managed by composer it's a matter of changing the version number in the composer.json file and running
composer update to have composer manage all the required packages, pull them down from their remote repositories, install them, and create a new composer.lock file that records all the new installed packages.