Docker images are immutable packages; Docker containers are running, configured instances created from those packages. An image supplies the application files, libraries, binaries, and startup defaults. A container adds a private writable layer, runtime settings, and a process. You can create many independent containers from one image, but deleting a container deletes its private writable layer unless important data is stored in a volume or bind mount.
The shortest accurate mental model
Think of an image as a packaged filesystem plus instructions and defaults, not merely a text recipe. It contains what an application needs to start: executable files, libraries, supporting files, environment defaults, and metadata. A container is what Docker creates when it turns that package into an isolated process with a particular command, network setup, mounts, name, and other options.
As an Amazon Associate I earn from qualifying purchases.
The lifecycle can be represented as:
Dockerfile + build context → image → create/configure → container → start process
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA registry can distribute the image between systems. When you run docker run IMAGE, Docker uses the referenced image, creates a new container configuration and writable layer, and starts the configured process. The image’s underlying layers remain unchanged while that process runs.
#1 Best Overall
Docker’s own definitions are deliberately concise: an image is “a read-only template with instructions for creating a Docker container,” and a container is “a runnable instance of an image.” Those definitions describe different roles, not two names for the same object.
What a Docker image contains
A reusable application package
An image packages the files, binaries, libraries, and configuration needed to run an application. It also records defaults such as the command or entrypoint to execute, the working directory, exposed ports, and environment values declared by the image author. Runtime options can override or supplement many of those defaults.
Images are identified by references such as nginx:alpine. The first part selects a repository and the tag selects a named variant. A digest can identify an exact immutable image content, while a tag is a convenient human-readable pointer that may be moved to newer content by its publisher.
Read-only layers
Images are assembled from layers. A Dockerfile instruction commonly contributes a layer or a filesystem change, and parent-image layers can be reused by other images. The layers are treated as read-only when a container uses them. This sharing is why several containers can start from one image without each needing a complete private copy of every base file.
Layer reuse does not mean that all images occupy no additional disk space. New or changed files still consume storage, and image listings may show cumulative sizes that include parent layers. Do not add displayed image and container sizes as though every byte were unique.
How an image is made
A Dockerfile describes the build, and the build context is the set of files Docker can access for that build. From a directory containing a Dockerfile, this command creates a tagged image:
docker build -t my-app .The final dot means “use the current directory as the build context.” The -t my-app option assigns a convenient reference. Building does not start an application and does not create a running container. It produces an image that can later be inspected, pushed to a registry, or used as the source for containers.
To obtain an image already published to a registry, use an image reference with docker pull, or let docker run pull it when the reference is not available locally. docker image ls lists images stored on the local Docker installation.
What a Docker container is
A configured runtime instance
A container combines an image with choices made for one invocation: its name, command, environment, network attachments, port mappings, mounts, resource limits, and restart behavior, among others. Docker then starts a process in an isolated environment. Containers are isolated processes, not full virtual machines; their exact isolation depends on the host, operating system, privileges, and options you select.
Two containers created from the same image can run different commands, use different ports, mount different directories, or receive different environment values. The image remains a common starting point, while each container has its own lifecycle and configuration.
The private writable layer
On top of the image’s read-only layers, Docker provides a container-specific writable layer. If a process edits a file that comes from the image, the original image layer is not edited. The changed version is written through the container’s writable layer. This copy-on-write behavior lets a process appear to modify its filesystem while preserving the source image for other containers.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →That writable layer is tied to the container. Stopping the container leaves it in existence, so starting it again can reuse the layer. Removing the container removes the layer. Data that must survive removal belongs in a separately managed volume or a bind mount.
Images and containers compared
| Aspect | Image | Container |
|---|---|---|
| Role | Read-only template or package used to create containers | Runnable instance of an image plus runtime configuration |
| Created by | Built from a Dockerfile and context, or obtained from a registry | Created from an image with commands, mounts, networking, and other options |
| Filesystem | Layered filesystem treated as immutable | Image layers plus a private writable layer and optional mounts |
| Multiplicity | One image can be the source for many containers | Each container has its own name, state, process, and writable layer |
| Typical commands | docker build, docker pull, docker image ls |
docker create, docker run, docker ps, docker stop, docker rm |
| Removal effect | Removing a container does not alter its source image | Removing the container deletes its writable layer; separately mounted data can remain |
What the everyday Docker commands actually do
Build an image
- Place a Dockerfile and the required application files in a build context.
- Run
docker build -t my-app .. - Confirm the result with
docker image ls. The image is available locally but is not running.
Create a container without starting it
docker create --name my-app my-image creates a container named my-app from my-image and leaves it in the created state. Docker records the configuration and allocates the container’s writable layer, but it does not start the application process.
Start that prepared container later with:
docker start my-appThis separation is useful when you want to inspect or prepare a container before its first start.
Create and start in one command
docker run --name my-app my-image combines creation and startup. The command must include an image reference. If that image is not present locally, Docker attempts to pull it from the configured registry. Options placed on the command line determine the container’s runtime configuration.
For example, a detached web process might be started with:
docker run --name web -d -p 8080:80 nginx:alpineHere, nginx:alpine is the image reference, --name web gives the container a stable name, -d runs it in the background, and -p 8080:80 maps port 8080 on the host to port 80 in the container. The mapping is a property of this container invocation, not a permanent change to the image.
Inspect running and stopped containers
docker ps lists running containers. Use docker ps -a to include containers that have exited or were created but never started. A stopped container still exists and can be started again; it has not been removed merely because its process stopped.
Stop, restart, and remove
docker stop my-app asks the container’s process to stop and then leaves the container record and writable layer in place. docker start my-app can start it again using its existing configuration and writable layer.
docker rm my-app removes the container and its writable layer. Removing a container does not remove the image used to create it. A separately managed volume normally remains unless you explicitly remove that volume; check your command and mount configuration before deleting anything that contains data.
Where container data goes
Data written only inside the container
Files written to the container’s writable layer are suitable for temporary state, caches, and disposable runtime changes. They are not a backup strategy. Once the container is removed, that layer is gone with it.
Stopping is different from removing: a stopped container preserves its writable layer because the container still exists. This can make a test appear to have persistent data until someone recreates the container, at which point the data disappears unless it was mounted elsewhere.
Volumes for managed persistent data
A Docker volume is stored and managed separately from the container. It is the usual choice for database files, uploads, shared application state, and write-intensive workloads that must outlive a container. Create and mount one explicitly:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesdocker volume create app-data
docker run --name app -v app-data:/var/lib/app my-imageRemoving app does not by itself remove app-data. The volume can be mounted into a replacement container, provided the replacement expects the same path and compatible data format.
Rank #4
Bind mounts for host directories
A bind mount maps a directory or file from the host into the container. It is useful when source code must be edited with host tools, when an existing host directory is the authoritative data location, or when you need direct visibility into files. Because it exposes a host path, permissions, portability, and host-specific layout require more care than with a managed volume.
Both mount types are outside the container’s writable layer. Mounting a path also hides any image-provided files at that path for the life of the mount, so choose the destination deliberately.
Can multiple containers use one image?
Yes. One image can be the source for many containers. Each container gets its own writable layer and its own runtime settings, while read-only image layers can be shared. For example:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →docker run --name worker-a -d my-app
docker run --name worker-b -d my-appThese commands create two distinct containers. They do not share private filesystem changes, process state, or container names. If they need common durable data, mount the same volume only when the application is designed for concurrent access; sharing a directory does not automatically make writes safe.
Each container also needs compatible networking and port choices. Two containers cannot both bind the same host port at the same time, even if they use the same image. They can still listen on the same internal port when they are attached to separate network namespaces and published through different host ports or through a shared reverse proxy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A complete image-to-container walkthrough
1. Build the starting package
With a Dockerfile in the current directory, run:
docker build -t reports-api .The tag reports-api is a local reference. At this point there is an image, but no container and no running process.
2. Create a persistent data location
docker volume create reports-dataThe volume is an independent object. Its lifetime is not tied to any single container.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Create and start a configured instance
docker run --name reports-api-1 -d -v reports-data:/var/lib/reports reports-apiDocker creates a container from reports-api, applies the name and volume mount, and starts the image’s default process in detached mode.
4. Check the container state
docker ps
docker ps -aThe first command confirms whether the process is currently running. The second also shows an exited container, which helps distinguish a failed process from a container that was never created.
5. Stop and replace it
docker stop reports-api-1
docker rm reports-api-1
docker run --name reports-api-2 -d -v reports-data:/var/lib/reports reports-apiThe first container’s writable layer is removed with docker rm, but the mounted volume remains available to reports-api-2. This is the normal replacement pattern for immutable application instances with separately managed state.
Common mistakes and the precise fix
“A container is just an image.”
It is not. The image is the reusable source; the container is the configured runtime instance. A container has a writable layer and a lifecycle state that an image does not have.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Editing a file in a container edits the image.”
It does not. The edit is recorded in that container’s writable layer or in a mounted path. To make a change part of a reusable image, change the Dockerfile or build inputs and build a new image.
“Stopping deleted my data.”
Stopping leaves the container and its writable layer. Data is normally lost when the container is removed or replaced, or when the process itself deletes it. Put durable data in a volume or bind mount and verify the mount destination.
“The image ID and container ID are interchangeable.”
They identify different object types. An image reference selects what to use as the source. A container name or container ID identifies a particular created instance. Commands such as docker stop and docker rm require a container name or ID.
“The displayed sizes can be added to calculate disk usage.”
Shared layers can be counted more than once in human-readable listings. Use Docker’s own disk-usage inspection when you need accounting, and remember that a container’s writable data and mounted volumes have different lifecycles.
Recommended Free Tools
Storage-driver details and the current implementation caveat
The layer model remains the clearest way to understand image reuse and container writes, but the storage implementation is version-sensitive. Docker’s storage-driver documentation focuses on classic storage drivers and notes that fresh Docker Engine 29.0 and later installations use the containerd image store by default. Consequently, examples that describe a particular classic driver may not match the files or directories used by a new installation.
This does not change the operational rules in this guide: image content is treated as read-only, a container has its own writable changes, and persistent application data should be mounted separately. If you are diagnosing disk usage or migrating an installation, check the storage configuration and Engine version rather than assuming a driver-specific path.
Choosing the right object for a task
- Need a reusable application package? Build or pull an image.
- Need to start a process with specific ports, environment values, or mounts? Create or run a container from that image.
- Need to pause without discarding the instance? Stop the container; do not remove it.
- Need a fresh instance with the same application files? Remove or replace the old container and create another from the image.
- Need data after replacement? Use a volume or bind mount and document the path and ownership expectations.
- Need to change application code or dependencies permanently? Update the build inputs and produce a new image rather than relying on edits in a running container.
What to remember
An image is the portable, layered, read-only package. A container is one configured execution of that package, with a private writable layer and a process. docker build produces images; docker create prepares containers; docker run creates and starts them; docker stop leaves a container in place; and docker rm removes the container and its ephemeral layer. Volumes and bind mounts are the boundary between disposable container state and data that must survive.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
