Yep. The entire disk. When you log out, it is encrypted. When you log in, it is decrypted.
The only practical way to get your data is a thief would have to steal the machine while you are logged in, and not let it sleep or reboot or log out. Then they could do everything you could do....without a PW. Your encrypted DMG would still require a PW, as would any admin tools they tried while it is booted.
One of the best things about full disk encryption is that with an unencrypted drive, the drive could be removed from the machine (or the Mac to be booted to Target Disk Mode, at least for 10.13 and older) and it would be fairly simple to bypass permissions and other normal security hurtles. An encrypted drive is always encrypted, and removing it from the machine does not change or weaken that.
File Vault is fairly painless. Just don't ever lose your PW...cuz it locks out everyone without the PW, even you.