Docker images vs containers explained
image definition, container definition, image layers, read-only vs read-write layer, image tags, container lifecycle
Images and Containers Are Not the Same Thing
An image is a read-only template - a snapshot of a filesystem plus metadata. A container is a running instance of that image, like an object instantiated from a class. One image can spawn as many containers as you need.
Layered Filesystem
Images are built in layers. Each instruction in a Dockerfile adds one layer. Layers are cached and shared across images, which is why pulling node:20 after already having node:18 is fast - the base layers are already on disk.
When a container starts, Docker adds a thin read-write layer on top of the image layers. Any files you write inside the container go into this layer. When the container is deleted, that layer is gone too - images are never mutated.
Image Tags
docker pull nginx:1.25 # specific version
docker pull nginx:latest # latest stable
docker pull nginx:alpine # alpine-based smaller image
Tags are just labels pointing to a specific image digest. latest is just a convention - it is not guaranteed to be the newest build.
Inspect Images and Containers
docker images # list local images
docker ps # list running containers
docker ps -a # list all containers including stopped ones