Summary: Working with Images

This chapter taught us the important theory and fundamentals of images:

• We learned that images contain everything needed to run an application as a container. This includes just enough OS, source code, dependencies, and metadata. We can start one or more containers from a single image.

• Under the hood, Docker constructs images by stacking one or more read-only layers and presenting them as a unified object. Every image has a manifest that lists the layers that make up the image and how to stack them.

• We learned that image names are also called tags; they’re mutable, and they don’t always pull the same image. For example, pulling the alpine:latest tag today will not pull the same image as it will a year from now. Fortunately, every image gets an immutable digest that we can use to guarantee we always pull the same image.

• Docker Hub offers curated official images that should be safer to use than unofficial images. However, we should always exercise caution when downloading software from the internet, even official images from Docker Hub.

• Images can share layers for efficiency, and Docker makes it easy to build and pull images for many different CPU architectures, such as ARM and AMD.

• Docker Scout scans images for known vulnerabilities and provides remediation recommendations. It requires a Docker subscription and is integrated into the Docker CLI, Docker Hub, and Docker Desktop.