Chapter Two

Images

An image is the read-only artifact a container runs from — and underneath the friendly tag it is a stack of content-addressed layers named by a SHA-256 digest. This chapter reads images the way you'd read a dependency's source: their layers, their manifests, the difference between a movable tag and an immutable digest, how pulling fills the local store, and how the base you build on sets size and security surface for the life of the image.

6 topics

Chapter 1 drew the line between an image and a container. This chapter takes the image apart. An image is an ordered stack of read-only layers, each a set of filesystem changes, merged into one root filesystem by a union mount — and identified not by its tag but by the SHA-256 digest of its manifest. Once you can read that structure, an image stops being a black box and becomes a dependency you can audit before you trust it.

You will inspect the two images Driftwood depends on — the official postgres:16 and nginx:1.27-alpine — before building anything of your own: their layers, their digests, their sizes, and what their history hides. Along the way the pieces that matter for reproducibility fall into place: why a deleted file doesn't shrink an image, why a tag can change under you while a digest cannot, why the second pull is instant, and why the base image you pick is the most consequential single line in a Dockerfile.