Images, containers and layers
🎯You'll be able to
Explain what an image and a container are, how they differ from a virtual machine, and read the layers of an image.
🏠The everyday picture
A tiffin service cooks one recipe and packs identical boxes. The recipe card is the image: written once, never changed. Each box sent out is a container: a running copy made from the recipe. If one box is spilled, you pack another from the same card; you don't repair the spilled one.
📘What it really is
-
An image is a read-only bundle: a small filesystem (the app, its libraries, a minimal operating system userland) plus settings such as which command to start and which port the app listens on.
-
A container is a running process started from an image, with its own view of files, network and process list. Several containers can run from one image at once; each gets a thin writable layer on top, which is thrown away when the container is removed.
-
Containers share the host computer's kernel (the core of the operating system). A virtual machine has its own kernel and pretends to be a whole computer. So containers start in about a second and use little memory, while virtual machines take longer but separate workloads more strongly.
-
Images are built in layers. Each instruction in a Dockerfile that changes files (
COPY,RUN) adds a layer. Layers are shared between images and cached, so a change near the end of a Dockerfile rebuilds only the last few layers. -
Useful commands:
docker build -t routerani:1.0.0 appbuilds an image from theappfolder and names it;docker run --rm -p 3000:3000 routerani:1.0.0starts a container and removes it when it stops;docker pslists running containers;docker logs <name>shows what the app printed;-
docker history routerani:1.0.0lists the layers and the instruction that made each one. -
Containers are disposable. Anything the app writes inside the container is lost when it's removed, so data lives in a database or a volume (CD2), and settings come in from outside (environment variables).
📝A worked example
Input: in the RouteRani kit, run docker build -t routerani:latest app, then docker images routerani and docker history routerani:latest.
Expected output: one image of about 1.6 GB, and a history that starts with the many layers of the full node:22 base image, then your
COPY . . and RUN npm install layers. Measured on 1 November 2026 with Docker 29.9.2 on Linux; sizes vary a little by version. You'll
bring it under 250 MB in Lesson 2.
🌍Where it's used
- Hosting platforms: Google Cloud Run, AWS Fargate and Azure Container Apps run your image without you managing servers.
- Kubernetes: every pod runs one or more containers from images (CD5).
- Developer laptops: teams start the same database and cache versions as production with one command.
📝Case scenario
A college's results portal ran on a server that a staff member had set up by hand years earlier. When the server's disk failed on results day, nobody could remember which Node.js version and libraries it used, and rebuilding took two days. The next year the portal shipped as an image: a new server ran it within minutes of being started.
🖱️Try it
Run docker run --rm -it routerani:latest sh, then cat /etc/os-release and node --version, and type exit. Compare with the same
commands on your own computer. Success: you can say which operating system userland and Node.js version the image carries.
⚠️Common mistakes
- Treating a container like a server. Sign: people
docker execin to install fixes by hand. Fix: change the Dockerfile and build a new image. - Keeping data inside the container. Sign: uploads or bookings vanish after a redeploy. Fix: use a database or a volume.
- Assuming containers isolate like virtual machines. Sign: untrusted code is run as root in a container on a shared server. Fix: run as a normal user and, for untrusted code, use stronger isolation.
🛠️For your project
Project 1 test 3 inspects the image you build from app/: who it runs as, whether it has a health check and what was copied in.
✅Quick check
What's the difference between an image and a container?
Show the answer
An image is the read-only recipe; a container is a running copy made from it, with a thin writable layer that's thrown away.
Why do containers start faster than virtual machines?
Show the answer
They share the host's kernel, so there's no operating system to boot.