TOPIC CONTAINERS
Container Layers how images are built from stacked, cached snapshots
IN 10 SECONDS
Every `RUN`, `COPY`, or `ADD` in a Dockerfile creates an immutable layer. Layers stack to form the image. When you rebuild, only changed layers are recreated; unchanged layers come from cache. At runtime, a thin writable layer sits on top — changes never modify the underlying image.
GOTCHA Order matters in a Dockerfile. Put infrequent changes (OS packages) first and frequent changes (app code) last to maximize cache hits and keep builds fast.
HOW A LAYERED BUILD WORKS
01 Build kit reads the Dockerfile and executes each instruction sequentially.
02 Each RUN creates a new layer by running the command in a temporary container and snapshotting its filesystem.
03 Each COPY adds a layer containing just the copied files and their metadata.
04 Cache lookup before executing, Docker checks if a layer with the same parent + instruction hash already exists.
05 Final image is the union of all read-only layers, with metadata (CMD, ENTRYPOINT, ports) from the last layer.
POKE IT YOURSELF
docker history IMAGE_NAME — inspect every layer in an image
docker image inspect IMAGE_NAME — see full image metadata and layer digests
Drill this topic →
~65 sec read