Images, containers, and layers

A template and a running instance

An image is an immutable stack of filesystem layers plus metadata. A container is one running instance of that image with a thin writable layer on top, which is why starting one is fast and why anything written inside it disappears when it is removed.

Each build instruction adds a layer, and layers are content-addressed. Ten images built from the same base share that base on disk and in transfers — only the differing layers move.

The writable layer is also why data belongs in a volume. Treating a container filesystem as storage works right up until the first restart.