What’s the dif­fer­ence between Docker images and con­tain­ers?

Docker images and con­tain­ers ensure that isolated en­vi­ron­ments can be started and that ap­pli­ca­tions can be executed in them. This is why they are two of the most important com­po­nents of the Docker vir­tu­al­iza­tion platform and ecosystem. Here we explain what they are and look at the sim­i­lar­i­ties and dif­fer­ences between the two.

Docker con­tain­ers

Docker con­tain­ers are isolated execution units for ap­pli­ca­tions and their de­pen­den­cies. In this respect, they are very similar to virtual machines (VMs), but there are some important dif­fer­ences. The main dif­fer­ence is the degree of isolation. Since no ad­di­tion­al operating system need to be vir­tu­al­ized, the degree of isolation is slightly lower for con­tain­ers when compared with virtual machines. Instead, con­tain­ers share the operating system and core of the host system. This offers some ad­van­tages that fa­cil­i­tate and ac­cel­er­ate ap­pli­ca­tion de­vel­op­ment, but it also comes with a few dis­ad­van­tages.

Con­tain­ers consume fewer resources than virtual machines do. As a result, they perform better and can be started more quickly. They are also sig­nif­i­cant­ly more portable than virtual machines, as only the ap­pli­ca­tion that will be executed and its de­pen­den­cies need to be trans­port­ed. The low overhead of Docker con­tain­ers also makes it possible to execute several con­tain­ers on the same system si­mul­ta­ne­ous­ly.

One dis­ad­van­tage of this lower level of isolation is that con­tain­ers have poorer security compared to virtual machines. Since all con­tain­ers have access to the operating system kernel, an infected container could cause serious damage. This is why a VM should be used for ap­pli­ca­tions that require a higher level of security.

Docker images

A Docker image is a read-only template that is used by the Docker engine to create a container. This means that Docker con­tain­ers can be viewed as running instances of Docker images. The template contains the de­pen­den­cies of the ap­pli­ca­tion to be executed, the required runtime en­vi­ron­ment and the ap­pli­ca­tion code itself. As a template for con­tain­ers, images are used to create con­sis­tent, re­pro­ducible execution en­vi­ron­ments for ap­pli­ca­tions.

Docker images them­selves are stored as binary files but can also be stored in human-readable form. These text-based files are called Dock­er­files and contain all the in­struc­tions needed to restore the image.

Both Docker images and Dock­er­files are portable and can be trans­port­ed easily from system to system. This means that Docker images can be stored in Docker registry repos­i­to­ries such as Docker Hub and down­loaded from there. Running container instances can also be saved as image files using the Docker command docker commit.

What is the dif­fer­ence between a Docker image and container?

Docker images and con­tain­ers are basically the same thing, just in different forms. An image is a read-only template for a container that contains all the necessary files, de­pen­den­cies and runtime en­vi­ron­ments for executing an ap­pli­ca­tion, as well as the ap­pli­ca­tion itself. A container, on the other hand, is a running, non-read-only instance of this image file, just as a running program is an instance of the program files installed on a hard disk.

This means that an image is a binary file that is stored in the file system of the host computer and a container is a running process that is located in the system’s RAM. Just as a Docker image is used to create a Docker container, a running container can also be saved as an image. This, in turn, can be used to create an exact repli­ca­tion of the same container.