Docker Made Crystal Clear · chapter 3: Images, Layers, and Where Containers Come From
The docs' five-layer Python image, redrawn
2026-09-09
The image layers (locks) are frozen diffs, stacked by a union filesystem into one view; chroot points the container's root at it. Each container adds exactly one writable layer of its own on top, so Container A and Container B share every frozen layer and still cannot see each other's changes.
Below: the paragraph from the book that builds this idea, then the diagram itself (Figure 3.1), and a recap. About a minute of reading.
So how does a running container write anything? When the union filesystem is assembled, Docker adds one more ingredient: a directory created specifically for that running container, stacked on top of the image layers as its writable layer. Every file your container creates, modifies, or deletes lands there, "keeping original layers untouched". Each container gets its own; none of them touches the image. Figure 3.1 draws the full arrangement.
Recap
- The idea: The image layers (locks) are frozen diffs, stacked by a union filesystem into one view; chroot points the container's root at it.
- The picture: Figure 3.1, from chapter 3 ("Images, Layers, and Where Containers Come From") of Docker Made Crystal Clear.
- Go deeper: the chapter builds this step by step, with recipes and sources at the end.
This diagram is one of many in Docker Made Crystal Clear.
Every chapter opens with the gist, draws the hard ideas, and ends with recipes and sources.
Get the book
