The three things people confuse.
WHAT AN IMAGE IS
A packaged filesystem and configuration, read-only.
WHAT A CONTAINER IS
A running instance of an image, with a writable layer on top.
WHAT THE RELATIONSHIP IS
One image, many containers.
WHY THAT MATTERS
Changes inside a container are not in the image, and disappear with it.
WHAT A LAYER IS
A set of filesystem changes, stacked to form the image.
WHAT CREATES A LAYER
Each instruction in the build that changes the filesystem.
WHY LAYERS EXIST
They are shared between images and cached during builds.
WHAT THAT SAVES
Storage, transfer and build time.
WHY A DELETED FILE STILL OCCUPIES SPACE
Removing it in a later layer hides it; the earlier layer still contains it.
WHAT THAT MEANS
A secret added and then deleted remains in the image.
WHAT TO DO ABOUT IT
Never add it in the first place.
WHAT A TAG IS
A readable name pointing at an image.
WHAT IT IS NOT
Immutable. A tag can be moved to a different image.
WHAT THAT IMPLIES
Pulling the same tag twice may give different content.
WHAT TO USE WHERE IT MATTERS
The image digest, which is content-addressed and cannot change.
WHAT TO NEVER RELY ON IN PRODUCTION
The latest tag.
