In this lesson, you will learn how Docker balances the need for shared, immutable base images with the requirement for individual, temporary changes during runtime.
The Foundation: Read-Only Image Layers
When you pull an image (like ubuntu or nginx), you are downloading a series of read-only layers. These layers represent the filesystem exactly as it was when the image was built. Because they are immutable, multiple containers on your machine can share the same base layers without duplicating them on your disk. This is what makes container distribution so efficient: you only download the static code and dependencies once.
The Workspace: The Writable Container Layer
The magic happens the moment you run docker run. When a container starts, the container runtime adds a thin, writable layer on top of the stack of read-only image layers.
Think of this like placing a sheet of transparent plastic over a photograph. You can draw on the plastic, add notes, or even "cover up" parts of the photo, but the original photograph underneath remains untouched.
- Read-Only Layers: Hold the application binaries, configuration files, and OS libraries. You cannot modify these files while the container is running.
- Writable Layer: Holds any changes made during the container's lifecycle. If your application creates a log file, updates a temporary cache, or modifies a configuration file, those changes are stored exclusively in this thin top layer.
Practical Example
If you create a file inside a running container, it is saved in that top writable layer:
# Inside a running container
touch /app/new-data.txt
Because the underlying image layers are read-only, if you stop and delete this container, the new-data.txt file disappears forever. If you start a new container from the same image, it will launch with a fresh, empty writable layer, completely unaware of the changes you made in the previous instance. This separation ensures that your base images remain pristine and reusable, while your runtime modifications remain isolated to the specific container instance.
Key Takeaway: Read-only image layers provide a stable, shared foundation, while the single writable layer provides a transient workspace for your container's unique runtime modifications.