Comparison
Container imagevsImage layer
Container image
you ship a tarball of a whole filesystem plus a line saying what to run, and the same bytes go to every environment.
The build output a container is started from: a stack of filesystem layers plus a small configuration document naming the entrypoint, environment and working directory. It is the unit that makes 'works on my machine' testable, because the machine travels with the code. The thing people underestimate is that it is a filesystem, not a package — everything the process opens at runtime either has to be in there or has to be mounted in.
Full entry →Image layer
changing one line at the top of the build file invalidates every layer beneath it and the build goes from nine seconds to four minutes.
One filesystem diff produced by a single build step, content-addressed and stacked with the others to form the image. Layers are shared and cached across images, which is what makes pulling a new build of the same service cheap. The whole practical skill of writing a build file is ordering steps so the slow, rarely-changing ones sit underneath the fast, always-changing ones.
Full entry →