Application Design & Build

An image is an immutable, read-only template (a stack of filesystem layers + metadata); a container is a running, writable instance created from an image.

Images are built from stacked, read-only layers (one per Dockerfile instruction typically) combined via a union filesystem; a thin writable layer is added at container runtime.

Layers are cached; a changed instruction invalidates that layer and all layers after it. Put rarely-changing steps (deps install) before frequently-changing ones (COPY app source) to maximize cache reuse.

A tag (e.g. nginx:1.25) is a mutable human-readable pointer that can be reassigned; a digest (nginx@sha256:...) is an immutable content-addressed hash guaranteeing the exact image.

Always, IfNotPresent, and Never.