Docker Images

Deep dive into Docker images, covering layers, Dockerfile best practices, multi-stage builds, image optimization, and registry management.

A Docker image is a lightweight, standalone, executable package that includes everything needed to run an application — code, runtime, system tools, libraries, and settings. Images are built from a series of layers, making them efficient to store, transfer, and rebuild.

Image Layer Architecture

	Layer 5: COPY app.py (Read-only) [4 KB]
	Layer 4: RUN pip install flask [15 MB]
	Layer 3: COPY requirements.txt [1 KB]
	Layer 2: RUN apt-get install python [45 MB]
	Layer 1: FROM ubuntu:22.04 (base) [78 MB]

Writing Effective Dockerfiles

Basic Dockerfile

Example

FROM node:18-alpine WORKDIR /app # Install dependencies first (better caching) COPY package*.json ./ RUN npm ci --only=production # Copy application code COPY . . EXPOSE 3000 CMD ["node", "server.js"]

Multi-Stage Build (Optimized)

Example

# Stage 1: Build FROM node:18-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci COPY . . RUN npm run build # Stage 2: Production (minimal image) FROM node:18-alpine AS production WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/node_modules ./node_modules COPY package*.json ./ USER node EXPOSE 3000 CMD ["node", "dist/server.js"]

Go Application (Smallest Possible Image)

Example

# Build stage FROM golang:1.21-alpine AS builder WORKDIR /app COPY go.mod go.sum ./ RUN go mod download COPY . . RUN CGO_ENABLED=0 GOOS=linux go build -o /app/server . # Final stage - scratch (empty base image) FROM scratch COPY --from=builder /app/server /server COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ EXPOSE 8080 ENTRYPOINT ["/server"]

Image Management Commands

bash example

# Build an image
docker build -t myapp:v1.0 .
docker build -t myapp:v1.0 -f Dockerfile.prod .

# List images
docker images
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# Tag an image
docker tag myapp:v1.0 registry.example.com/myapp:v1.0
docker tag myapp:v1.0 myapp:latest

# Push to registry
docker push registry.example.com/myapp:v1.0

# Pull from registry
docker pull nginx:1.25-alpine

# Remove images
docker rmi myapp:v1.0
docker image prune -a  # Remove all unused images

# Inspect image layers
docker history myapp:v1.0
docker inspect myapp:v1.0

# Save/Load images (offline transfer)
docker save myapp:v1.0 | gzip > myapp-v1.0.tar.gz
docker load < myapp-v1.0.tar.gz

Image Optimization Best Practices

Practice	Before	After	Savings
Use alpine base	900 MB	150 MB	83%
Multi-stage builds	800 MB	50 MB	94%
Minimize layers	15 layers	5 layers	Faster builds
.dockerignore	Includes node_modules	Excludes them	500 MB+
Order COPY wisely	Rebuilds all layers	Only changed	Faster

bash example

# .dockerignore file
node_modules
npm-debug.log
.git
.env
*.md
docker-compose*.yml
.dockerignore
Dockerfile

Container Registries

Registry	Provider	Best For
Docker Hub	Docker Inc	Public images, OSS
Amazon ECR	AWS	AWS deployments
Azure ACR	Microsoft	Azure deployments
Google GCR/Artifact Registry	Google	GCP deployments
GitHub Container Registry	GitHub	GitHub Actions CI/CD
Harbor	Open-source	Self-hosted, enterprise

bash example

# AWS ECR usage
aws ecr get-login-password | docker login --username AWS \
  --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com

docker tag myapp:v1 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1

Interview Questions

What are Docker image layers and why are they important?

Each Dockerfile instruction creates a read-only layer. Layers are cached and shared between images — if two images use the same base, they share those layers on disk. This makes builds faster (cached layers aren't rebuilt) and storage efficient.

What is a multi-stage Docker build and when would you use it?

Multi-stage builds use multiple FROM statements to create intermediate build containers. Only the final stage is in the output image. Use when you need build tools (compilers, SDKs) during build but not at runtime — resulting in much smaller production images.

How would you optimize a Docker image from 1GB to under 100MB?

Use a minimal base (alpine), multi-stage builds (exclude build tools), combine RUN commands (fewer layers), use .dockerignore, remove package manager caches, and for Go/Rust use scratch base with static binaries.

What is the difference between CMD and ENTRYPOINT in a Dockerfile?

CMD provides default arguments that can be overridden at runtime. ENTRYPOINT defines the executable that always runs. Together: ENTRYPOINT sets the command, CMD sets default arguments. Use ENTRYPOINT for the main process, CMD for configurable defaults.

How do container registries work and why are they important?

Registries store and distribute Docker images. When you docker push, layers are uploaded; docker pull downloads them. They enable version control for images, team collaboration, CI/CD integration, and vulnerability scanning. Private registries secure proprietary images.

Image Layer Architecture

	Layer 5: COPY app.py (Read-only) [4 KB]
	Layer 4: RUN pip install flask [15 MB]
	Layer 3: COPY requirements.txt [1 KB]
	Layer 2: RUN apt-get install python [45 MB]
	Layer 1: FROM ubuntu:22.04 (base) [78 MB]

Writing Effective Dockerfiles

Basic Dockerfile

Example

Multi-Stage Build (Optimized)

Example

Go Application (Smallest Possible Image)

Example

Image Management Commands

bash example

# Build an image
docker build -t myapp:v1.0 .
docker build -t myapp:v1.0 -f Dockerfile.prod .

# List images
docker images
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# Tag an image
docker tag myapp:v1.0 registry.example.com/myapp:v1.0
docker tag myapp:v1.0 myapp:latest

# Push to registry
docker push registry.example.com/myapp:v1.0

# Pull from registry
docker pull nginx:1.25-alpine

# Remove images
docker rmi myapp:v1.0
docker image prune -a  # Remove all unused images

# Inspect image layers
docker history myapp:v1.0
docker inspect myapp:v1.0

# Save/Load images (offline transfer)
docker save myapp:v1.0 | gzip > myapp-v1.0.tar.gz
docker load < myapp-v1.0.tar.gz

Image Optimization Best Practices

Practice	Before	After	Savings
Use alpine base	900 MB	150 MB	83%
Multi-stage builds	800 MB	50 MB	94%
Minimize layers	15 layers	5 layers	Faster builds
.dockerignore	Includes node_modules	Excludes them	500 MB+
Order COPY wisely	Rebuilds all layers	Only changed	Faster

bash example

# .dockerignore file
node_modules
npm-debug.log
.git
.env
*.md
docker-compose*.yml
.dockerignore
Dockerfile

Container Registries

Registry	Provider	Best For
Docker Hub	Docker Inc	Public images, OSS
Amazon ECR	AWS	AWS deployments
Azure ACR	Microsoft	Azure deployments
Google GCR/Artifact Registry	Google	GCP deployments
GitHub Container Registry	GitHub	GitHub Actions CI/CD
Harbor	Open-source	Self-hosted, enterprise

bash example

# AWS ECR usage
aws ecr get-login-password | docker login --username AWS \
  --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com

docker tag myapp:v1 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:v1

Interview Questions

What are Docker image layers and why are they important?

What is a multi-stage Docker build and when would you use it?

How would you optimize a Docker image from 1GB to under 100MB?

What is the difference between CMD and ENTRYPOINT in a Dockerfile?

How do container registries work and why are they important?

Docker Images

Image Layer Architecture

Writing Effective Dockerfiles

Basic Dockerfile

Multi-Stage Build (Optimized)

Go Application (Smallest Possible Image)

Image Management Commands

Image Optimization Best Practices

Container Registries

Interview Questions

Continue learning this concept

Docker Images

Image Layer Architecture

Writing Effective Dockerfiles

Basic Dockerfile

Multi-Stage Build (Optimized)

Go Application (Smallest Possible Image)

Image Management Commands

Image Optimization Best Practices

Container Registries

Interview Questions

Continue learning this concept