Layers and Union Filesystems
You start ten containers from the quicknotes image, which is 150 MB. Your disk does not lose 1.5 GB; it barely moves. And when you pull a new version of the image, only a small part downloads. Both tricks come from how images are stored: as layers merged by a union filesystem.
The rule
An image is a stack of read-only layers; a container adds one thin writable layer.
Each instruction in a Dockerfile that changes files (RUN, COPY, ADD) produces a new layer: a record of just the files it added, changed or deleted.
FROM python:3.12-slim # base layers
COPY requirements.txt . # layer: one file
RUN pip install --no-cache-dir -r requirements.txt # layer: libraries
COPY . . # layer: app codeA union filesystem (on modern Linux, Docker's overlay2 storage driver) stacks these layers and shows them as one ordinary folder tree. When a container starts, Docker puts one empty writable layer on top. From that come three rules:
- Sharing. All ten quicknotes containers read the same image layers from disk. Only their small writable layers differ.
- Copy-on-write. When a container changes a file that lives in an image layer, the file is first copied up into its writable layer and changed there. The image is untouched.
- Deletes only hide. Removing a file that exists in a lower layer just records a "whiteout" marker on top. The bytes stay in the lower layer.
The shortcut
Read the stack from the top down: the first layer that has the path wins. To predict what a container sees, or how big an image is, walk the layers top to bottom.
Layer A
RUN curl -o /tmp/data.tar.gz https://example.com/data.tar.gzstores a 300 MB file in layer A.
The same idea explains why ordering matters for build speed: if a layer changes, every layer above it must be rebuilt, so put rarely changing steps (installing libraries) before often changing ones (copying your code).
Drills
Answer fast — trust the rule.
Five containers run from the same image. What do they share on disk?
A running container edits /etc/app.conf, which came from the image. What happens?
One RUN adds a 200 MB file and the next RUN deletes it. How does the image size change?
Which storage driver does Docker use by default on current Linux systems?
Remember
- An image is a stack of read-only layers; each container adds one thin writable layer.
- Read the stack top-down: the first layer with the path wins, and changes are copied up.
- Trap: deleting in a later layer hides a file but never shrinks the image.