English
Menu

What is Container image?

A read-only template from which containers are created. It stacks the files of an application, such as executables, libraries and settings, in layers and adds configuration such as the command to start, and it does not contain an OS kernel. Images are built from a Dockerfile or similar and stored and distributed through registries. An image is specified by repository name and tag (for example web:1.4), or uniquely by a digest computed from its contents (sha256:…). Identical layers are shared between images.

Japanese name: コンテナイメージ

Container image appears in 3 practice questions across 1 topic, including Cloud and Container Basics.

Field: Cloud and Container Basics

How layers work

Each Dockerfile instruction that changes files (RUN, COPY and so on) becomes one layer. Layers are identified by a digest computed from their contents, so images built on the same base image share that layer, downloading and storing it only once. Deleting a file in a later layer leaves the contents of the earlier layer in the image, so large temporary files are either removed within the same instruction or kept out of the final image with a multi-stage build.

Tags and digests

A tag, such as web:1.4 or latest, is a name given by people and can later be moved to a different image. A digest is computed from the contents of the image and changes if even one bit differs. In production, or wherever exactly what was tested must be used, images are specified by digest.

Making images small and safe

Leaving out compilers and package managers that are not needed at run time makes images smaller, faster to pull and less exposed to vulnerabilities. A typical method is a multi-stage build that separates a build stage from a run-time stage. Secrets are not put in images but passed in at start-up.

Try it: questions about Container image

Which of the following correctly describes the relationship between a container image and a container?

  1. AWhen a container is stopped, the changes made inside it are automatically written back to the image, overwriting the original image
  2. BAn image is a read-only template, and several containers, each with its own writable layer, can be started from one image
  3. COnly one container at a time can be started from an image, and starting a second one requires copying the image under another name first
Show answer and explanation

Answer: B. An image is a read-only template, and several containers, each with its own writable layer, can be started from one image

An image is a read-only template that bundles the files and settings needed to run an application, and a container is a unit of execution created from an image. When a container is created, a writable layer of its own is stacked on top of the image's layers. Many containers can therefore be started from one image, and changes in one container affect neither the other containers nor the image. To keep a change as part of an image, the usual approach is to edit the Dockerfile and rebuild the image.

In a Kubernetes Deployment, the container image in the Pod template is changed to a new version. Which of the following correctly describes what happens with the default update strategy (RollingUpdate)?

  1. AA new ReplicaSet is created, and Pods of the new version are added while Pods of the old version are removed. The old ReplicaSet stays with 0 Pods for rollback
  2. BThe container image inside the running Pods is replaced with the new version in place without recreating the Pods, so neither the Pods' IP addresses nor their names change
  3. CAll Pods of the old version are deleted at once and then the Pods of the new version are created together, so the service stops temporarily during the update
Show answer and explanation

Answer: A. A new ReplicaSet is created, and Pods of the new version are added while Pods of the old version are removed. The old ReplicaSet stays with 0 Pods for rollback

When the Pod template changes, a Deployment creates a ReplicaSet for the new template and, while confirming that new Pods have become ready, gradually reduces the Pods of the old ReplicaSet. A certain number of Pods therefore keep handling requests during the update. The old ReplicaSet is kept with 0 Pods, so kubectl rollout undo can return to the previous version. The strategy that deletes all Pods first and then recreates them is Recreate, which is used only when specified explicitly.

FAQ

What is the difference between an image and a container?

An image is a read-only template, and a container is a running (or stopped) instance created from it. Many containers can be created from one image, and each gets its own writable layer. It is similar to the relationship between a program file and a process.

Does the latest tag always give the newest version?

latest is an ordinary tag with no special meaning. It is merely the default name used when no tag is given, and it does not point to a new version unless someone moves it. To pin a version, specify a concrete tag or a digest.

Questions that mention Container image (3)

  1. Which of the following correctly describes the relationship between a container image and a container?
  2. In a Kubernetes Deployment, the container image in the Pod template is changed to a new version. Which of the following correctly describes what happens with the default update strategy (RollingUpdate)?
  3. A container image built by a CI/CD pipeline was tested in the staging environment and passed. Which of the following is the most appropriate way to release this image to production?

Books on Cloud and Container Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Container Kubernetes Pod CI/CD (continuous integration and continuous delivery) Environment variable Autoscaling Availability zone Blue-green deployment Canary release Docker

Back to the glossary