Working with Docker Images
A Docker Image is an immutable, cryptographic package containing the application binaries, runtime dependencies, and system configuration required to instantiate a container. This chapter explores the underlyingOCI Image Specification, layer deduplication, production tagging strategies, and diagnostic inspection.
1. Anatomy of an OCI Image & Content-Addressable Storage
An image is not a single archive file. It is a bundle consisting of an Image Manifest, a Configuration JSON Blob, and a sequence of gzipped tarball filesystem layers:
1. Image Manifest
JSON descriptor document defining the schema version, target CPU architecture, and a cryptographic list of layer hashes.
2. Config JSON
Stores container execution metadata: environment variables, default exposed ports, working directory, and ENTRYPOINT.
3. Layer Tarballs
Gzipped tarballs holding the filesystem delta (added, changed, or deleted files) created by Dockerfile build steps.
FROM node:20-alpine, Docker only downloads and stores the 40 MB Node.js base layer once on your host disk. All 10 images share that identical physical layer!2. Tagging Strategies & The ":latest" Anti-Pattern
When pulling an image without specifying a tag (e.g. docker pull node), Docker defaults to :latest. In production deployments, relying on :latest is a catastrophic anti-pattern:
| Tag Strategy | Example | Risk Level | Production Verdict |
|---|---|---|---|
| Implicit Latest | node (equals node:latest) | Critical Risk | Banned in Production. Upstream changes can break builds silently at 3 AM. |
| Major Floating | python:3 or postgres:16 | Medium Risk | Accepts non-breaking minor/patch updates automatically, but risks breaking edge-cases. |
| Semantic Version (SemVer) | postgres:16.2-alpine | Low Risk | Recommended for Staging & Dev. Pins exact runtime and base distribution. |
| Immutable Digest Pinning | redis@sha256:7f0b... | Zero Risk | Enterprise Gold Standard. Cryptographically guarantees zero supply-chain drift. |
3. Production CLI Workflows
A. Inspecting Layer Breakdown: docker image history
Reveals the exact size and command line instruction that generated each layer:
docker image history --human --no-trunc python:3.12-slimB. Tagging for Enterprise Registries
The standard image naming format follows: [registry_domain/][namespace/]repository:tag:
# 1. Tag for public Docker Hub:
docker tag my-local-app:v1.0 dockerhub_user/ecommerce-api:v1.0.0
# 2. Tag for AWS Elastic Container Registry (ECR):
docker tag my-local-app:v1.0 123456789012.dkr.ecr.us-east-1.amazonaws.com/ecommerce-api:v1.0.0
# 3. Tag for GitHub Container Registry (GHCR):
docker tag my-local-app:v1.0 ghcr.io/my-org/ecommerce-api:sha-a8f3b2C. Offline Air-Gapped Image Transfer: save & load
Export an image to a raw tarball to deploy on high-security networks without internet access:
# On development machine connected to the internet:
docker save -o secure-api-v1.tar my-local-app:v1.0
# Transfer tarball via USB / SCP, then load on air-gapped production host:
docker load -i secure-api-v1.tarNext Up: Writing Production Dockerfiles
In Chapter 6, learn how to construct lean, efficient, and cached container images using modern Dockerfile directives.
Chapter 06: Writing a Dockerfile →
