Layered Images

Docker images aren't single tarballs — they're stacks of layers. Each RUN instruction in a Dockerfile creates a layer; the final image is the layered result.

Dockerfile:
  FROM ubuntu:22.04                  # base layer (or 6 base layers)
  RUN apt-get update                 # layer 7: package indexes
  RUN apt-get install nginx          # layer 8: nginx + deps
  COPY ./site /var/www/html          # layer 9: site files
  CMD ["nginx", "-g", "daemon off;"] # metadata only — no layer

Layer storage: each layer is a tarball + manifest, content-addressed by SHA-256. They live in /var/lib/docker/overlay2/<sha>/.

Sharing: if two images use ubuntu:22.04 as base, they SHARE those layers on disk. Pulling a new image only downloads layers you don't already have. This is why "alpine" is popular — small base = fewer bytes to ship.

Image assembly via OverlayFS:

lowerdir=ubuntu_base:nginx_install:apt_indexes  (read-only stack)
upperdir=container_writes                       (read-write top)
workdir=temp_workspace
mount -t overlay overlay -o lowerdir=...,upperdir=...,workdir=... /merged

The container sees a single /merged directory. Reads come from any layer (top first); writes always go to upperdir. Modifying a file in a lower layer does copy-on-write to upperdir.

This is why you can RUN apt-get install once and reuse the result across thousands of containers — the bytes are read-only and shared.