Docker images, containers and volumes explained

Docker packages a program together with everything it needs to run, so that it behaves the same on a laptop, a test server and in production. Almost everything you do with Docker touches one of three objects: images, containers and volumes. Once the difference is clear, the command line stops feeling random.

Images: the read-only template

An image is a frozen file system plus some metadata: which command to start, which ports the program listens on, which environment variables it expects. Images are built from a Dockerfile and are made of layers. Each instruction in the Dockerfile adds a layer on top of the previous one, and layers are shared between images, which is why pulling a second image based on the same base is fast.

Images are named like repository:tag, for example nginx:1.27 or postgres:17. If you leave out the tag, Docker assumes latest, which is a moving target and not a good idea on servers. Images live in a registry; Docker Hub is the default, and docker pull downloads from there.

docker pull nginx:1.27
docker image ls
docker image history nginx:1.27
docker image inspect nginx:1.27

Containers: a running copy with a writable layer

A container is what you get when you run an image. Docker takes the image layers, adds one thin writable layer on top, gives the process its own network interface and process list, and starts the command. You can start many containers from the same image and they do not see each other’s changes.

The writable layer belongs to that one container. When the container is removed with docker rm, everything written there is gone. Stopping a container does not delete it; the files stay until you remove it, which is why docker ps -a often shows a long list of exited containers.

docker run -d --name web -p 8080:80 nginx:1.27
docker ps
docker logs web
docker exec -it web sh
docker stop web
docker rm web

-d runs the container in the background, --name gives it a name you can refer to, and -p 8080:80 publishes port 80 inside the container as port 8080 on your machine. Without -p the service is reachable only from other containers.

Volumes: storage that survives the container

Because the writable layer disappears with the container, anything you care about, such as a database’s data directory or uploaded files, must live somewhere else. That is what volumes are for. A volume is a directory managed by Docker, stored on the host, that is mounted into the container at a path you choose. Remove the container, start a new one with the same volume, and the data is still there.

docker volume create pgdata
docker run -d --name db -e POSTGRES_PASSWORD=example -v pgdata:/var/lib/postgresql/data postgres:17
docker volume ls
docker volume inspect pgdata

There is a second kind of mount, the bind mount, which maps a normal host directory into the container, for example -v "$PWD":/app. Bind mounts are handy during development because edits on the host appear in the container immediately. Named volumes are the better choice for data a service owns, because Docker manages their location and permissions.

Careful: docker volume rm and docker volume prune delete data permanently. A volume is only removed by prune when no container references it, but a volume you forgot to attach counts as unused.

How they fit together

• Image: built once, read-only, shared, versioned by tag. Commands start with docker image or docker build.
• Container: a process started from an image, with its own writable layer and network. Commands start with docker container, or the short forms docker run, docker ps, docker stop.
• Volume: persistent storage attached to one or more containers. Commands start with docker volume.
• Network: the fourth object you meet soon after. Containers on the same user-defined network can reach each other by name. Commands start with docker network.

A good mental model: images are like installation media, containers are like a machine you booted from it, and volumes are like an external disk you plug into that machine.

Official documentation

• Docker concepts: What is a container?
• Docker concepts: What is an image?
• Docker storage: Volumes