Part I · How it works
7.3 Images, layers and overlayfs
alsocontainer imagedocker imageimage layersoverlayfsoverlayoverlay2dockerfiledocker buildvolumevolumesdocker volumebind mountdocker system df
TL;DR
- An image is a stack of read-only layers, one per build step, plus some settings (command, environment). Layers are shared between images.
- Running it adds a thin writable layer on top. overlayfs merges them into one root filesystem: you see the top-most version of each file.
- Data you want to keep belongs in a volume or a bind mount, outside the container's layers.
docker history IMAGE # its layers and their sizes
docker system df # space used by images, containers, volumes
docker run -v data:/var/lib/postgresql/data postgres
On your machine
$ atfq 7.3 Here no container or virtual machine detected Isolated none: the host's namespaces (pid, user, uts, ipc, cgroup, time) Can run VMs with KVM (/dev/kvm) · containers with Docker Overlays 1 overlay mount: container layers, usually
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- Deleting a file in a later Dockerfile step doesn't shrink the image:
the earlier layer still holds it. Download, use and delete in one
RUN. - Changing an early step rebuilds every step after it: copy dependency lists and install them before copying the source code.
- A tag such as
postgres:16moves when it's updated; a digest (@sha256:…) never does. - Images and stopped containers pile up:
docker system df, then prune what you don't need.
Deep dive 2 questions
How does overlayfs work?
It mounts several folders as one: read-only lower layers and one
writable upper layer. Reading looks through from the top down. The first
write to a lower file copies the whole file up first ("copy-up"), which
is slow for big files. Deleting leaves a "whiteout" marker in the upper
layer that hides the file below. Your mount shows each running
container's overlay.
What's in an image file?
An OCI image is a manifest listing layers (tar archives, compressed) and a config. Every part is named by its SHA-256 digest, so a registry stores and sends each layer once, and pulling an image only downloads the layers you don't have yet.