Images and containers

Both of QuickCart’s problems have the same cause. The app is installed fresh on every machine, from whatever versions are around that day. QuickCart needs to build the app and everything it depends on once, check it, and then run that exact thing everywhere.

That is what a container image is.

An image is a package that holds everything your app needs to run: your code, the exact libraries it uses, and the small set of operating-system files those libraries expect. It’s built once and never changes.

A container is a running copy of an image. Start an image and you get a container. Start it five times and you get five containers, all identical.

Image and container, side by side

What a container really is

A container isn’t a small virtual machine. It’s an ordinary program running on the host’s operating system, with two restrictions the Linux kernel applies to it:

So a container shares the host’s kernel — the core of the operating system — with every other container on the machine. That’s why it’s small and quick, and it’s the difference from a virtual machine:

Containers usually run inside virtual machines, not instead of them. On AWS, your containers run on EC2 instances, which are virtual machines. On macOS and Windows, Docker Desktop runs a small Linux virtual machine, and your containers share its kernel. On Linux, containers share your own system’s kernel directly.

Images are made of layers

An image isn’t one big file. It’s a stack of layers, each one a set of file changes: a base Linux, then Python, then your libraries, then your code. Each line of a Dockerfile usually makes one layer.

Layers are shared. If two images use the same base, it’s downloaded and stored once. When you release a new version, a server downloads only the layers that changed — usually just your code, a few kilobytes.

Registries store images

A registry is a server that stores images, like an app store for containers. You push an image to it, and servers pull from it.

An image’s full name says where it lives:

A short name like nginx:1.27 is shorthand for docker.io/library/nginx:1.27 — the official nginx repository on Docker Hub.

Tags move. Digests don’t

A tag, like v1 or 1.27, is a label someone put on an image. Labels can be moved: anyone allowed to push can put v1 on a different image tomorrow.

A digest, like sha256:4f1c…, is calculated from the image’s contents. Change one byte, and the digest changes. So a digest always means exactly the same image.

And latest is not special. It’s just the tag Docker uses when you don’t give one. It usually means “whatever was pushed most recently”, so it tells you nothing about what’s running. Don’t release with it.

“Works on my laptop”, solved — with one catch

An image fixes library versions, system files and settings. It can’t fix the processor. The programs inside an image are compiled for one type of chip:

Below are four QuickCart apps — orders, menu, payments and delivery — packed onto one server. Start with Virtual machines, then switch to Containers. Choose Add an app in each, and drag the stack to turn it.

What to notice: the thick guest operating system layer appears once for every app with virtual machines, and not at all with containers. That missing layer is why a container is megabytes instead of gigabytes, and starts in a second. It’s also why containers share one kernel: that is the price of being light.

Free — everything runs on your own computer.

You’ll pull a real image, run two containers from it, look inside one, and tidy everything away. About 20 minutes.

You need Docker installed and running. Set up your computer covers it. On macOS and Windows, open Docker Desktop and wait until it says it’s running. On Linux, the Docker service starts on its own.

1. Check Docker works

   TerminalCopy

   docker run --rm hello-world

   Part	What it means
   docker run	start a container from an image. If the image isn’t on your computer yet, download it first
   --rm	remove the container as soon as it finishes
   hello-world	a tiny image that prints a message and exits

   You should see

   Unable to find image 'hello-world:latest' locally
   latest: Pulling from library/hello-world
   Status: Downloaded newer image for hello-world:latest
   
   Hello from Docker!
   This message shows that your installation appears to be working correctly.

   Between these lines you’ll also see a Pull complete line and a Digest line, and after them more text explaining what just happened. Notice the first line: you didn’t give a tag, so Docker used latest.

2. Pull an image with a real version

   TerminalCopy

   docker pull nginx:1.27

   Part	What it means
   docker pull	download an image from a registry, without running it
   nginx	the repository: the official nginx web server on Docker Hub
   :1.27	the tag: version 1.27. Always name a version rather than relying on latest

   You should see

   1.27: Pulling from library/nginx
   a2318d6c47ec: Pull complete
   7bd1fe4d8e2b: Pull complete
   c9ba5b3e04d7: Pull complete
   Digest: sha256:<64 letters and numbers>
   Status: Downloaded newer image for nginx:1.27
   docker.io/library/nginx:1.27

   Your layer IDs and digest will be different, and there are several more Pull complete lines. Each Pull complete line is one layer. Copy the Digest line somewhere; you’ll use it in step 6. The last line is the image’s full name.

   Now list the images on your computer:

   TerminalCopy

   docker images

   Part	What it means
   docker images	list every image stored on this computer

   You should see

   A row for nginx with tag 1.27, and one for hello-world. Each has an image ID and a size. The exact columns depend on your Docker version.

3. Run a container

   TerminalCopy

   docker run -d -p 8080:80 --name web nginx:1.27

   Part	What it means
   docker run	start a container
   -d	detached: run it in the background and give you your terminal back
   -p 8080:80	publish a port: connections to port 8080 on your computer go to port 80 inside the container, where nginx listens
   --name web	call the container web, so later commands can use the name
   nginx:1.27	the image to start it from

   You should see

   4d29ffd981e4c0a7b5e1d2f3a9c8b7e6d5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0

   That long string is the new container’s ID. Yours will be different. Now open http://localhost:8080 in your browser.

   You should see

   A page headed Welcome to nginx! It came from inside the container, through the port you published.

4. See what's running

   TerminalCopy

   docker ps

   Part	What it means
   docker ps	list running containers. Add -a to include stopped ones

   You should see

   CONTAINER ID   IMAGE        COMMAND                  CREATED          STATUS          PORTS                                     NAMES
   4d29ffd981e4   nginx:1.27   "/docker-entrypoint.…"   30 seconds ago   Up 29 seconds   0.0.0.0:8080->80/tcp, [::]:8080->80/tcp   web

   The PORTS column shows the port you published. Next, see what nginx has written to its log:

   TerminalCopy

   docker logs web

   Part	What it means
   docker logs	print everything a container has written to its output
   web	which container

   You should see

   Some start-up lines from nginx, then a line for your browser’s visit containing "GET / HTTP/1.1" 200. On AWS, this same output is what ends up in CloudWatch Logs.

5. Start a second container from the same image

   One image can run as many containers as you like. Each needs its own name and its own port on your computer:

   TerminalCopy

   docker run -d -p 8081:80 --name web2 nginx:1.27

   Part	What it means
   -p 8081:80	this time, port 8081 on your computer goes to port 80 in the new container
   --name web2	a different name; two containers can’t share one
   nginx:1.27	the same image as before. Nothing is downloaded this time

   Open http://localhost:8081. The same page, from a second, separate container.

6. Look inside, and find the shared kernel

   Run a command inside the running container to see which Linux the image contains:

   TerminalCopy

   docker exec web cat /etc/os-release

   Part	What it means
   docker exec	run a command inside a container that’s already running
   web	which container
   cat /etc/os-release	print the file that names the Linux distribution

   You should see

   PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
   NAME="Debian GNU/Linux"
   VERSION_ID="12"

   There are more lines after these. The image carries Debian’s files, whatever system your computer runs. Now ask for the kernel:

   TerminalCopy

   docker exec web uname -r

   Part	What it means
   uname -r	print the version of the kernel this program is running on

   You should see

   A kernel version number. With Docker Desktop it ends in linuxkit, such as 6.10.14-linuxkit: the kernel of the small Linux virtual machine inside Docker Desktop. On Linux, it’s your own system’s kernel, such as 6.8.0-45-generic. Run the same command with web2 instead of web and you get the identical answer: both containers share one kernel. Only the files are their own.

7. Run an image by its digest

   A tag can move; a digest can’t. Use the digest you copied in step 2. Replace DIGEST with everything after sha256::

   TerminalCopy

   docker run --rm nginx@sha256:DIGEST nginx -v

   Part	What it means
   nginx@sha256:DIGEST	the image with exactly this content. @ instead of : means “by digest”, not “by tag”
   nginx -v	instead of starting the web server, run this command: print nginx’s version
   --rm	remove the container when the command finishes

   You should see

   nginx version: nginx/1.27.5

   Your patch number may be different. Whatever happens to the 1.27 tag later, this digest will always run exactly the image you have now.

8. Clean-up step: Clean up

   Stop both containers:

   TerminalCopy

   docker stop web web2

   Part	What it means
   docker stop	ask containers to shut down cleanly. Docker waits up to 10 seconds, then forces them
   web web2	the containers to stop

   You should see

   web
   web2

   Remove them:

   TerminalCopy

   docker rm web web2

   Part	What it means
   docker rm	delete stopped containers, including anything they wrote. Their names are free again

   You should see

   web
   web2

   Delete the images too:

   TerminalCopy

   docker image rm nginx:1.27 hello-world

   Part	What it means
   docker image rm	delete images from this computer. It refuses while any container, even a stopped one, still uses them
   nginx:1.27 hello-world	the two images you downloaded

   You should see

   Untagged: and Deleted: lines for each image. Run docker ps -a and docker images: neither lists anything from this lab.