containerimages

ContainerImages are portable, immutable bundles that package an application and its runtime environment into a filesystem snapshot. They contain all dependencies needed to run the software, including the code, libraries, and configuration, allowing the same image to be executed consistently across different hosts and environments. A container image is not itself running code; it is a read-only artifact that a container runtime uses to create a writable container instance.

An image is composed of layered filesystem changes and metadata. Each layer represents a set of file changes and is stacked on top of previous layers. The topmost layer is writable in the running container, while underlying layers remain read-only. Images are described by a manifest and a configuration object that record attributes such as entrypoint, command, environment variables, exposed ports, author, and creation time. The Open Container Initiative OCI Image Specification defines the standard format; Docker images are compatible with OCI, and many runtimes support the OCI model.

Images are stored and distributed via registries. Public registries (for example, Docker Hub) and private registries host tagged image references, which can be pulled by container runtimes. A digest (a content-addressable SHA) uniquely identifies a specific image content, while tags provide a human-friendly label. Multi-architecture images use manifest lists to select the appropriate architecture at pull time.

Building images typically involves a build tool and a build description (for example, a Dockerfile). Practices such as multi-stage builds, minimal base images, and removing build-time dependencies reduce image size. Security considerations include scanning for vulnerabilities, image signing, and enforcing provenance checks to ensure authenticity and integrity.

ContainerImages enable reproducible deployments, rapid scaling, and efficient storage through shared layers and caching. They are central to modern container ecosystems, enabling portability across cloud, on-premises, and edge environments.