Sign in Get started

Docker Tutorial · Docker Basics · Lesson 3 of 26

Images and Layers

Pull images, list them, and see how images are made of shared, read-only layers.

Create a free account to save this page, take notes and track your progress. Sign in

Pulling and listing

docker pull nginx:1.29-alpine downloads an image; docker run pulls automatically if needed. The part after the colon is the tag. Without a tag Docker uses latest, which can change at any time, so pin tags (or digests) for anything you deploy.

Layers

An image is a stack of read-only layers. Each filesystem-changing Dockerfile instruction adds one. Layers are content-addressed and shared: ten images built on the same base store the base once. A running container adds a thin writable layer on top; changes there disappear when the container is removed.

Inspect an image's layers and metadata
docker image ls --format '{{.Repository}}:{{.Tag}}' | grep -E '^(alpine:3.24|nginx:1.29-alpine)$' | sort
echo "layers in nginx:1.29-alpine: $(docker image inspect nginx:1.29-alpine --format '{{len .RootFS.Layers}}')"
echo "default command: $(docker image inspect nginx:1.29-alpine --format '{{json .Config.Cmd}}')"
echo "exposed ports:   $(docker image inspect nginx:1.29-alpine --format '{{json .Config.ExposedPorts}}')"

Output

alpine:3.24
nginx:1.29-alpine
layers in nginx:1.29-alpine: 8
default command: ["nginx","-g","daemon off;"]
exposed ports:   {"80/tcp":{}}

Run this on your computer — see “Get Started” for setup.

See Understanding image layers.

Test yourself

Why should production deployments avoid the latest tag?

  1. latest is slower
  2. latest can point to a different image at any time, so deployments aren't reproducible
  3. latest images can't be pulled
  4. Docker forbids it
Show answer

Answer: latest can point to a different image at any time, so deployments aren't reproducible

Pin a specific tag or digest so every deployment runs the same image.

Was this page helpful?