3 Docker Images
A focused guide to Docker Images, connecting core concepts with practical Docker and container operations.
Docker images are the read-only, layered artifacts that define everything a container needs to run: a filesystem built from an ordered stack of layers, plus metadata describing default configuration such as environment variables, exposed ports, and the command to execute when a container starts from it.
What an Image Actually Contains
An image bundles a filesystem (built incrementally through layers) together with configuration describing how a container should behave by default, all identified by a content-based digest that uniquely represents that exact combination.
docker inspect myapp:1.0
This returns the full set of metadata associated with an image: its layers, its default environment variables, its exposed ports, and its default startup command, among other details.
Building Images
Images are typically built from a Dockerfile, a sequence of instructions that each produce a new layer, starting from a base image and ending with the application's own files and configuration.
FROM python:3.12-slim
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "app.py"]
docker build -t myapp:1.0 .
Images Are Immutable
Once built, an image's contents do not change; a "modified" image is, in practice, an entirely new image with a different digest, even if it shares many layers with the original.
docker images --digests myapp
This reports the unique digest for each tagged image, confirming that even visually similar tags can refer to entirely distinct, immutable image contents.
Tags as Convenient References
Tags such as myapp:1.0 or myapp:latest are human-readable labels pointing at a specific image digest, and the same tag can be reassigned to point at a different digest over time, which is why digests, not tags, are the only truly immutable reference to a specific image's exact contents.
docker pull myapp@sha256:abc123...
Why Understanding Images Matters
Everything else in the Docker ecosystem — containers, registries, orchestration — operates on images as its fundamental unit, so a solid understanding of what an image actually is (a layered filesystem plus configuration, immutable and content-addressed) underlies almost every other concept built on top of it.