Images and layers

Docker · lesson 2 of 31 · 3 min read

Understand how an image is built from stacked read-only layers and why that makes builds fast.

Open this lesson in the learning hub

Key points

  • An image is a stack of read-only layers plus metadata. A container is that stack plus one thin writable layer on top.
  • RUN, COPY and ADD each add a layer. ENV, WORKDIR and CMD only change metadata.
  • Layers are content-addressed by digest. Images that share a base share those bytes on disk and skip them on pull.
  • Deleting a file in a later layer only hides it. The bytes still ship, so never COPY a secret and then RUN rm.
  • Writes inside a running container land in its writable layer and vanish on docker rm.

Example

docker pull eclipse-temurin:21-jre

# every layer, newest first, with the instruction that made it
docker image history eclipse-temurin:21-jre

# the raw layer digests
docker image inspect eclipse-temurin:21-jre --format '{{json .RootFS.Layers}}'

Layers are append-only, cached and shared. Deleting never shrinks an image.

Containers vs virtual machines Your first Dockerfile

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Docker course, and every lesson in it is listed on the Docker contents page.