Docker Images

Learn Docker images as layered, immutable artifacts that define the filesystem and startup defaults for containers.

Last reviewed: June 2026

·Docker Engine 24+Docker Desktop 4+Docker Compose v2
✅
Quick Understanding: A Docker image is an immutable, layered template used to create containers. It contains application code, runtime dependencies, filesystem content, metadata, and default startup instructions.

🔍 What Is It?

A Docker image is a versioned package for a containerized application.

Images are built from layers. Each instruction in a Dockerfile usually creates a layer. Docker can reuse unchanged layers from cache, which makes builds and pulls faster.

Images are identified by:

  • →Repository name, such as orders-api
  • →Tag, such as 1.4.2
  • →Digest, a content-addressed immutable identifier

🎯 Why Do We Need It?

Images make deployments repeatable. Instead of reinstalling runtime dependencies on every server, you build the image once and run it wherever Docker-compatible infrastructure is available.

They are the artifact that CI validates and production deploys.

🏗️ What Happens in Real Projects?

A production image lifecycle often looks like:

  1. Developer merges code
  2. CI builds registry.company.com/orders-api:1.24.0
  3. CI runs tests and image scans
  4. CI pushes the image
  5. Deployment uses the image digest
  6. Rollback points to the previous digest

This gives release teams traceability from source commit to deployed container.

⚙️ How It Works

Docker images use a layered filesystem model.

When a container starts, Docker mounts the image layers as read-only and adds a thin writable container layer on top. Changes made by the running container go into that writable layer unless they are written to a mounted volume.

If the container is removed, the writable layer is removed too. The image remains.

💻 Example

Image Tags and Digests — Build, tag, inspect, and run an image.

bash
docker build -t registry.company.com/orders-api:1.24.0 .
docker images
docker inspect registry.company.com/orders-api:1.24.0
docker push registry.company.com/orders-api:1.24.0

# Production systems often deploy by digest
docker pull registry.company.com/orders-api@sha256:...

🤔 Common Confusions

❓ Is an image running?

No. An image is a template. A container is a running or stopped instance created from that image.

❓ Are tags immutable?

Technically no. A tag can be moved to another image. Digests are immutable and safer for production pinning.

❓ Why are images layered?

Layers improve caching, sharing, and transfer efficiency. Common base layers do not need to be downloaded repeatedly.

🚨 Common Production Issues

**Mutable latest tag** - deployments use `latest`, making rollbacks and audit trails unreliable.

**Secrets in layers** - credentials copied during build remain recoverable from image history.

**Unpatched base image** - old base layers include known vulnerabilities.

**Bloated layers** - package caches and build artifacts increase pull time and attack surface.

✅ Best Practices

Use meaningful version tags and deploy critical services by digest

Keep images small and focused on one application process

Do not bake secrets into images

Rebuild images regularly to pick up patched base layers

Use `.dockerignore` to avoid copying unnecessary files

Scan images before pushing or deploying

🏛️ Architect's Note

Senior Architect's Perspective

The image is the unit of release. Once teams understand that, deployment conversations become cleaner: what source commit produced this image, which tests approved it, which vulnerabilities were accepted, and which digest is running?

That traceability is more important than the Docker commands themselves.

💬 Frequently Asked Questions

What is a base image?

A base image is the starting filesystem and runtime layer, such as `node:22-alpine`, `eclipse-temurin:21-jre`, or `nginx:alpine`.

Can one image run multiple containers?

Yes. You can create many containers from the same image, each with separate runtime state.

What is `.dockerignore`?

It excludes files from the build context, reducing build time and avoiding accidental inclusion of local files or secrets.

🎯 Key Takeaways

1Images are immutable templates
2Containers run from images
3Layers enable caching and efficient pulls
4Tags are convenient but mutable
5Digests are best for strict production traceability

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these Docker references to verify the concept in official docs and continue into the most relevant SplashRide pages.