Core Concepts of Docker Images

What Is a Docker Image?

A Docker image is: - Immutable: Once built, its layers cannot be altered — any modification results in a new image.

• Layered: Composed of stacked read-only filesystem layers; identical layers across images are shared on disk (typically under /var/lib/docker/overlay2/), reducing storage overhead.
• Self-contained: Bundles an application binary, its dependencies, configuration files, and runtime environment — essentially a reproducible filesystem snapshot.

In essence: a Docker image is a versioned, portable archive of a minimal root filesystem.

Container vs. Image

A container is not "an instance of" an image — it’s a runtime construct derived from an image: - An image provides the base read-only filesystem layers.

• A container adds a thin writable layer (for runtime changes) and attaches Linux namespaces (PID, network, mount, etc.) and cgroups for isolation.
• Images exist independently; containers only exist while running (or paused/stopped).

Building Images

The standard, declarative method is via a Dockerfile, which defines build instructions step-by-step (e.g., FROM, COPY, RUN). This enables version control, reproducibility, and CI/CD integration. Image Lifecycle Operations

Searching for Images

Use docker search to discover publicly available images on Docker Hub: ``` docker search nginx

This returns names, descriptions, star counts, and official status indicators. ### Pulling Images Locally

To download an image: ```
docker pull alpine:3.19

If you encounter x509: certificate has expired or is not yet valid, verify system time: ``` yum install -y ntpdate && ntpdate -s time.windows.com

### Run Without Prior Pull

`docker run` automatically fetches missing images: ```
docker run --rm -it python:3.11-slim python -c "print('Hello from layered FS')"

The --rm flag ensures automatic cleanup after exit. ### Listing and Reomving Images

List all local images: ``` docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}"

Remove one or more by ID or name:tag: ```
docker rmi ubuntu:22.04 httpd:latest

To force removal (even if referenced), add -f. To prune unused images: docker image prune. Under the Hood: What Is an Image Really?

At its core, a Docker image is a collection of tarred filesystem layers and metadata (in JSON format). You can inspect its contents without running it: ```

Export the filesystem of a transient container

id=$(docker create alpine:3.19) docker export "$id" | tar -x -C /tmp/alpine-rootfs docker rm "$id"

View resulting structure

ls -F /tmp/alpine-rootfs/

bin/ dev/ etc/ home/ proc/ root/ run/ sbin/ sys/ tmp/ usr/ var/

This exported layout mirrors a minimal Linux root filesystem — confirming that Docker images are fundamentally archived, layered directories with embedded execution context.