Images and Containers: What Each One Holds

An image is a read-only package of files: a program, the libraries it needs, and a minimal operating system filesystem. A container is what you get when you run an image: the image's files, plus a thin layer where the container can write, plus a running process. The image never changes; everything that changes belongs to the container.

You can pull an image once, start ten containers from it, and when they have all finished the image is byte for byte what it was when you downloaded it.

An image is built as a stack of layers. Each layer holds a set of files, and the layers are laid over one another to form a single filesystem. All of them are read-only. When Docker starts a container, it adds one more layer on top, the writable layer, which belongs to that container alone:

Everything the container writes, creates or deletes is recorded in that top layer. When the container changes a file that came from the image, Docker first copies the file up into the writable layer and changes the copy, so the layers below are never touched.

You can see the two on your own machine: docker images lists images, and docker ps lists running containers. An image in the first list is not running anything; it is only files.

So removing a container never damages the image, and two containers started from the same image cannot see each other's files, because each one only ever writes to its own top layer.