Core Command Differences

Image Backup and Recovery (save + load)

Export Image

If the target image already exists on the host, you can export it directly to a local tar archive. Two valid syntaxes are supported:

# Redirect standard output to a tar file
docker save <image-name[:tag]> | <image-id> > <output-archive-path>.tar
# Use built-in -o flag to specify output file
docker save -o <output-archive-path>.tar <image-name[:tag]> | <image-id>

Usage example: Export the existing custom-nginx:v2.3 image to nginx-image-backup.tar

docker save custom-nginx:v2.3 > nginx-image-backup.tar
# Equivalent command
docker save -o nginx-image-backup.tar custom-nginx:v2.3

Import Image

Restore the exported image archive to the Docker environment with the following commands:

# Use -i flag to specify input archive path
docker load -i <path-to-image-archive>.tar
# Redirect standard input from the tar file
docker load < <path-to-image-archive>.tar

Usage example: Import the nginx-image-backup.tar archive

docker load -i nginx-image-backup.tar
# Equivalent command
docker load < nginx-image-backup.tar

Container Backup and Recovery (export + import)

Export Container

Export a running or stopped container to a flattened tar archive:

# Use -o flag to specify output archive path
docker export -o <output-container-archive>.tar <container-name> | <container-id>
# Redirect standard output to a tar file
docker export <container-name> | <container-id> > <output-container-archive>.tar

Usage example: Export the running container named nginx-runtime-01 to nginx-container-backup.tar

docker export -o nginx-container-backup.tar nginx-runtime-01
# Equivalent command
docker export nginx-runtime-01 > nginx-container-backup.tar

Import Container as Image

Restore the exported container archive to a new Docker image:

# Import from local archive file
docker import <path-to-container-archive>.tar <new-custom-image-name[:tag]>
# Import from remote HTTP/HTTPS resource
docker import <remote-archive-url> <new-custom-image-name[:tag]>

Usage example:

# Import local archive to create image restored-nginx:v2.3
docker import nginx-container-backup.tar restored-nginx:v2.3
# Import remote archive to create base image
docker import https://internal-repo.example.com/assets/ubuntu-base.tgz internal/ubuntu-minimal:22.04

Commit Container Changes to New Image

When running a container without mounting external volumes, all file modificasions inside the container are stored in the container's writable storage layer. The docker commit command packages the base image plus the container's writable layer into a new standalone image, which retains all runtime changes from the original conatiner.

This operation is not recommended for regular production image building for the following reasons:

1. The generated image often contains a large amount of temporary files, logs and unrelated content, leading to excessive image size.
2. Images generated by docker commit are black-box images, as there is no transparent record of the operations performed inside the container, making subsequent maintenance and traceability difficult.

Applicable scenarios for docker commit enclude post-intrusion forensics site preservation, temporary runtime change verification, etc.

Commit Command Usage

docker commit [OPTIONS] <container-name | container-id> <new-image-name[:tag]>

Usage example: Commit the running container nginx-prod-02 to a new image nginx-custom-proxy:v1.1

[admin@node01 ~]$ docker commit nginx-prod-02 nginx-custom-proxy:v1.1
sha256:7f9d2c4e8a1b03f56d7e9c2a8b10d3e5f7a9c2b4e6a8d0f1c3e5b7a9d2c4e8f1

[admin@node01 ~]$ docker images
REPOSITORY          TAG   IMAGE ID       CREATED        SIZE
nginx-custom-proxy  v1.1  7f9d2c4e8a1b   3 seconds ago  142MB

Common optional parameters:

• -a: Specify the author information of the committed image
• -c: Execute Dockerfile instructions during commit to adjust image configuration
• -m: Add descriptive commit message for change tracking
• -p: Pause the running container during commit to avoid data inconsistency caused by concurrent writes

The new image generated by docker commit can be backed up and restored using the docker save and docker load workflow documented earlier.