Images, Tags and Registries
A Kubernetes manifest never contains your code. It contains one line — image: ghcr.io/example/notes-web:1.2 — and the cluster fetches everything else. Reading that line correctly is a daily skill.
The rule
An image is the recipe's result; a container is one serving of it.
An image is a read-only package: the app, its runtime and its libraries, stacked in layers. A container is a running instance of an image. One image can start many containers, just as one cake recipe can feed many plates.
Images are built from a Dockerfile:
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "server.py"]Each instruction adds a layer. Layers are cached and shared, so rebuilding after a code change only redoes the steps from the first changed line down. That is why dependencies are copied and installed before the rest of the code.
Images live in a registry — Docker Hub, GitHub Container Registry, or your cloud's registry. An image reference has parts:
ghcr.io / example/notes-web : 1.2
registry repository tag- No registry written? Docker Hub is assumed.
- No tag written?
latestis assumed. - A digest such as
@sha256:3f1a…names one exact build and can never point elsewhere.
The shortcut
Read every image line right to left: which version (tag or digest), which app (repository), from where (registry). If the version part is missing or says latest, stop and pin it.
Right part: version
ghcr.io/example/notes-web:1.2— the tag is1.2, a fixed release you chose.
The trap is latest. It is just a tag name, not a promise of the newest version, and it can point to a different build tomorrow. Two nodes may then run two different versions of "the same" app.
Drills
Answer fast — trust the rule.
What is the relationship between an image and a container?
In ghcr.io/example/notes-web:1.2, what is 1.2?
A manifest says image: postgres. What does the cluster pull?
Why is a digest reference safer than a tag for production?
Remember
- An image is the packaged result; a container is one running serving of it.
- Read references right to left: version, app, registry.
- Trap:
latestis just a movable label — pin a tag or digest.