DockerImage

A Docker image is a read-only template that contains a complete filesystem, including the application code, runtime, libraries, and settings needed to run a specific piece of software in a container. Images are built from a sequence of instructions, typically defined in a Dockerfile, and are composed of layered filesystem changes that accumulate to form the final image.

The image structure relies on layers. Each instruction in a Dockerfile creates a new layer, which is cached and can be shared by multiple images. When an image is run, a writable top layer is added to the read-only layers, producing a container. Because layers are content-addressed, they enable efficient storage and transfer, as unchanged layers can be reused rather than redownloaded.

Docker images are portable and can run on any system with a compatible container runtime. They are distributed through registries such as Docker Hub or private registries. Images are identified by a repository name and a tag (for example, repository:tag) and may also be referenced by a content digest (sha256) to ensure integrity and reproducibility.

Building and distributing images involve the Dockerfile workflow: writing instructions, building with a tool like docker build, and pushing to or pulling from registries. Techniques such as multi-stage builds help reduce image size by separating build-time dependencies from the final runtime environment.

Security and maintenance considerations include keeping images minimal, avoiding running the container as root, scanning for known vulnerabilities, applying updates, and validating provenance. Images can be publicly available or restricted to trusted registries, emphasizing the importance of supply chain security in container deployments.