TopolearnEvery Docker command acts on either images or containers, so keeping them apart avoids most beginner confusion.
An image is a packaged filesystem plus metadata: everything the application needs (a minimal OS userland, runtime, libraries, your code) and settings such as the default command, environment variables and working directory. Images are read-only and built from stacked layers.
A container is a running (or stopped) instance of an image. Docker adds a thin writable layer on top of the image's layers, gives the process its isolated environment and starts the default command. You can start many containers from one image; they share the image's read-only layers and each gets its own writable layer. Delete a container and its writable layer, with any files written into it, is gone. The image is untouched.
The class/object analogy works well: the image is the class, containers are instances.
Images are named registry/namespace/repository:tag:
nginx:1.27is shorthand fordocker.io/library/nginx:1.27(Docker Hub, official image).ghcr.io/acme/api:2.3.1is on GitHub's registry.- If you omit the tag you get
:latest, which is just a default tag name, not "the newest version".
Tags are movable labels. The immutable identity of an image is its digest, such as nginx@sha256:4f1c..., a hash of its content. Production deployments often pin digests for exact reproducibility.
docker pull downloads an image; docker run pulls automatically if needed. Images are fetched layer by layer, and layers you already have are skipped.
Example
docker pull nginx:1.27 # download an image
docker image ls nginx
# REPOSITORY TAG IMAGE ID CREATED SIZE
# nginx 1.27 9bea9f2796e2 2 weeks ago 192MB
docker run -d --name web1 nginx:1.27 # two containers,
docker run -d --name web2 nginx:1.27 # one image
docker ps --format '{{.Names}} {{.Image}}'
# web2 nginx:1.27
# web1 nginx:1.27
docker image inspect nginx:1.27 --format '{{index .RepoDigests 0}}'
# nginx@sha256:...Remember
- Image = read-only layered template; container = instance + writable layer
- Many containers can share one image
- Name format: registry/namespace/repo:tag; :latest is only a default tag
- Digests are immutable; tags can move
Watch out for
- Assuming :latest means the newest release — it's whatever was last pushed with that tag, or nothing at all.