Container foundations
Connect images, containers, and registries
Trace an image from a registry to the local cache and into one or more containers without confusing their lifecycles.
8 minute lesson
An image name such as nginx:alpine combines a repository and tag. Docker pulls missing image layers from a registry, normally Docker Hub unless the name says otherwise.
A tag is a readable pointer, not proof that content never changes. An image digest identifies exact content. Multiple containers can share the same read-only image layers while each gets its own writable layer.
docker pull node:22-alpine
docker image ls node
docker run --rm node:22-alpine node --versionTags make images convenient for humans, but deployment records should include the digest returned by the registry. A maintainer can move a tag to different content; a digest lets another machine pull the exact bytes you tested. This matters most for broad tags such as latest or 22-alpine.
An image name can also resolve to a multi-platform manifest. Docker selects an architecture-specific image for the current machine. Before production, use docker image inspect or the registry UI to confirm both the digest and supported platform rather than assuming an image built on a laptop will run everywhere.
Pull the image, run two short-lived containers from it, and compare the image ID shown by docker image ls.
Lesson completed