Images vs Containers

What Is an Image?

A Docker image is a read-only template that contains everything needed to run a container: the application code, runtime, system libraries, environment variables, and configuration. Images are immutable — once built, they never change.

Images are composed of layers stacked on top of each other. Each layer represents a set of filesystem changes. When you pull an image from a registry, Docker downloads only the layers it does not already have locally, making transfers efficient.

What Is a Container?

A container is a running instance of an image. When you execute docker run, Docker takes an image and creates a container by adding a writable layer on top. The container is the process, the image is the blueprint.

# Pull an image (read-only, stored locally)
docker pull nginx:alpine

# Run a container (running process with writable layer)
docker run -d --name web nginx:alpine

# The image is immutable — both containers use the same base
docker run -d --name web2 nginx:alpine

# List images
docker image ls nginx:alpine

# List containers
docker ps

Image Layers

Each instruction in a Dockerfile creates a new layer. Layers are stacked and each one contains the filesystem changes from that step. This layering system enables caching, sharing, and efficient storage.

FROM node:20-alpine          # Base layer (Alpine Linux + Node)
WORKDIR /app                 # Creates /app directory
COPY package*.json ./        # Copies package files
RUN npm ci --production      # Installs dependencies
COPY . .                     # Copies application code
CMD ["node", "server.js"]    # Sets default command

The Writable Layer

When a container starts, Docker adds a thin writable layer on top of the image layers. All changes made during the container's lifetime — new files, modified files, deleted files — are recorded in this layer. When the container is removed, the writable layer is destroyed and all changes are lost.

This is why containers are ephemeral. If you need to persist data, use volumes rather than writing to the container's filesystem. Volumes exist outside the container lifecycle and survive container removal.

Identifying Images and Containers

Docker identifies images and containers by unique IDs — long hexadecimal strings. You can reference them by short ID prefix, tag, or digest. Understanding these references prevents confusion when working with multiple versions.

# Image ID (full 64-char SHA256 hash)
docker image inspect nginx:alpine --format '{{.Id}}'

# Short image ID
docker image ls --format '{{.ID}} {{.Repository}}:{{.Tag}}'

# Container ID
docker ps --format '{{.ID}} {{.Names}}'

# Reference by digest (immutable)
docker pull nginx@sha256:abc123...

# Reference by tag (mutable — can point to different images)
docker pull nginx:latest

Container Lifecycle States

Containers move through defined states. Understanding the lifecycle helps you manage containers correctly and avoid common pitfalls like orphaned processes.