21 Days of Docker-Day 8-Docker Images, Layers & Containers

3 min readOct 14, 2019

Welcome to Day 8 of 21 days of Docker, let’s try to dig deeper into images and layers.

A Docker image is built up from a series of layers. Each layer represents an instruction in the image’s Dockerfile. Each layer except the very last one is read-only.

Consider the following Dockerfile

FROM ubuntu:15.04
RUN apt-get -y install nginx
COPY index.html /var/www/html
CMD ["nginx","-g","daemon off;"]

This Dockerfile contains four commands each of which creates a layer

FROM: statements starts out by creating a layer from the ubuntu 15.04 image
RUN: Command install nginx
COPY: add some files to nginx www directory
CMD: command specify which command to run within the container

Some points to keep in mind

Each layer is only a layer of differences from the layer before it.
The layers are stacked on top of each other
When you create a new container, you add a new writable layer on top of the underlying layers. This layer is often called the “container layer”
All changes made to the running container, such as writing new files, modifying existing files, and deleting files, are written to this thin writable container layer
If you want to check the layer of the image

$ docker image history nginx
IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
f949e7d76d63        2 weeks ago         /bin/sh -c #(nop)  CMD ["nginx" "-g" "daemon…   0B                  
<missing>           2 weeks ago         /bin/sh -c #(nop)  STOPSIGNAL SIGTERM           0B                  
<missing>           2 weeks ago         /bin/sh -c #(nop)  EXPOSE 80                    0B                  
<missing>           2 weeks ago         /bin/sh -c ln -sf /dev/stdout /var/log/nginx…   0B                  
<missing>           2 weeks ago         /bin/sh -c set -x     && addgroup --system -…   56.8MB              
<missing>           2 weeks ago         /bin/sh -c #(nop)  ENV PKG_RELEASE=1~buster     0B                  
<missing>           2 weeks ago         /bin/sh -c #(nop)  ENV NJS_VERSION=0.3.5        0B                  
<missing>           2 weeks ago         /bin/sh -c #(nop)  ENV NGINX_VERSION=1.17.4     0B                  
<missing>           4 weeks ago         /bin/sh -c #(nop)  LABEL maintainer=NGINX Do…   0B                  
<missing>           4 weeks ago         /bin/sh -c #(nop)  CMD ["bash"]                 0B                  
<missing>           4 weeks ago         /bin/sh -c #(nop) ADD file:1901172d265456090…   69.2MB

A storage driver handles the details about the way these layers interact with each other.

Different storage drivers are available(eg: overlay2, devicemappers, aufs), which have advantages and disadvantages in different situations.

Difference between Image and Container

To sum up, what we have discussed so far, the major difference between a container and an image is the top writable layer.
All writes to the container that adds new or modifies existing data are stored in this writable layer.
When the container is deleted, the writable layer is also deleted.
The underlying image remains unchanged.
Because each container has its own writable container layer, and all changes are stored in this container layer, multiple containers can share access to the same underlying image and yet have their own data state(as shown in the above image)

To read the complete story