What is the difference between containers and images in docker?

This article introduces the difference between containers and images in docker. I hope it can help you.

(Recommended tutorial: docker tutorial)

When I still had a little understanding of Docker technology, I found that I understood Docker's commands are very difficult. So, I spent a few weeks learning how Docker works, or more specifically, the union file system, and then looking back at the Docker commands, everything fell into place. , extremely simple.

Digression: Personally, the best way to master a technology and use it rationally is to have a deep understanding of the working principles behind the technology. Usually, the birth of a new technology is often accompanied by media hype and hype, which makes it difficult for users to see the true nature of the technology. Rather, new technologies always invent new terms or metaphors to help inform the This is very helpful in the early stage, but it puts a layer of sandpaper on the principle of technology, which is not conducive to users mastering the true meaning of technology in the later stage.

Git is a good example. I couldn't use Git well before, so I spent some time learning the principles of Git. It was only then that I really understood the usage of Git. I firmly believe that only those who truly understand the internals of Git can master this tool.

Image Definition

Image is the unified perspective of a bunch of read-only layers. Maybe this definition is a bit difficult to understand. The following picture can help readers understand. Definition of mirror.

From the left we see multiple read-only layers, which overlap. Except for the bottom layer, all other layers will have a pointer pointing to the next layer. These layers are implementation details inside Docker and can be accessed on the file system of the host (Translator's Note: the machine running Docker). Union file system technology can integrate different layers into one file system, providing a unified perspective for these layers, thus hiding the existence of multiple layers. From the user's perspective, only one file exists system. We can see what this perspective looks like on the right side of the image.

You can find files about these layers on your host file system. Note that these layers are not visible inside a running container. On my host, I found that they exist in the /var/lib/docker/aufs directory.

sudo tree -L 1 /var/lib/docker/

/var/lib/docker/
├── aufs
├── containers
├── graph
├── init
├── linkgraph.db
├── repositories-aufs
├── tmp
├── trust
└── volumes
7 directories, 2 files

Container Definition

The definition of container (container) is almost exactly the same as that of image (image). It is also a unified perspective of a bunch of layers. The only difference is that the top layer of the container is readable and writable.

Careful readers may find that the definition of a container does not mention whether the container is running. Yes, this is intentional. It was this discovery that helped me understand a lot of my confusion.

Key points: container = image readable layer. And the definition of a container does not mention whether to run the container.

Next, we will discuss running containers.

Running Container Definition

A running container (running container) is defined as a readable and writable unified file system plus an isolated process space and the processes contained in it. The image below shows a running container.

It is the file system isolation technology that makes Docker a promising technology. A process in a container may modify, delete, or create files, and these changes will affect the read-write layer. The picture below demonstrates this behavior.

     

我们可以通过运行以下命令来验证我们上面所说的： 

docker run ubuntu touch happiness.txt

即便是这个ubuntu容器不再运行，我们依旧能够在主机的文件系统上找到这个新文件。 

find / -name happiness.txt

/var/lib/docker/aufs/diff/860a7b...889/happiness.txt

Image Layer Definition

为了将零星的数据整合起来，我们提出了镜像层（image layer）这个概念。下面的这张图描述了一个镜像层，通过图片我们能够发现一个层并不仅仅包含文件系统的改变，它还能包含了其他重要信息。 

     

元数据（metadata）就是关于这个层的额外信息，它不仅能够让Docker获取运行和构建时的信息，还包括父层的层次信息。需要注意，只读层和读写层都包含元数据。 

     

除此之外，每一层都包括了一个指向父层的指针。如果一个层没有这个指针，说明它处于最底层。 

     

Metadata Location: 
我发现在我自己的主机上，镜像层（image layer）的元数据被保存在名为”json”的文件中，比如说： 

/var/lib/docker/graph/e809f156dc985.../json

e809f156dc985...就是这层的id 

一个容器的元数据好像是被分成了很多文件，但或多或少能够在/var/lib/docker/containers/目录下找到，就是一个可读层的id。这个目录下的文件大多是运行时的数据，比如说网络，日志等等。 

全局理解（Tying It All Together）

现在，让我们结合上面提到的实现细节来理解Docker的命令。 

docker create

     

docker create 命令为指定的镜像（image）添加了一个可读写层，构成了一个新的容器。注意，这个容器并没有运行。 

     

docker start

     

Docker start命令为容器文件系统创建了一个进程隔离空间。注意，每一个容器只能够有一个进程隔离空间。 

docker run

     

看到这个命令，读者通常会有一个疑问：docker start 和 docker run命令有什么区别。 

As you can see from the picture, the docker run command first creates a container using the image, and then runs the container. This command is very convenient and hides the details of the two commands, but on the other hand, it is easy for users to misunderstand.

Digression: Continuing our previous topic about Git, I think the docker run command is similar to the git pull command. The git pull command is a combination of git fetch and git merge. Similarly, docker run is a combination of docker create and docker start.

docker ps

docker ps command will list all running containers. This hides the existence of non-running containers. If we want to find these containers, we need to use the following command.

docker ps –a

docker ps –a command will list all containers, whether they are running or stopped.

docker images

The docker images command will list all top-level images. In fact, here we have no way to distinguish between a mirror and a read-only layer, so we propose top-level mirroring. Only the image used when creating the container or the image directly pulled down can be called a top-level image, and there are multiple image layers hidden under each top-level image.

docker images –a

docker images –a command lists all images, which can also be said to list all readable images. layer. If you want to view all layers under a certain image-id, you can use docker history to view it.

docker stop

The docker stop command will send a SIGTERM signal to the running container and then stop all process.

docker kill

The docker kill command sends an unfriendly SIGKILL to all processes running in the container Signal.

docker pause

The docker stop and docker kill commands will send UNIX signals to the running process, docker The pause command is different. It uses the characteristics of cgroups to pause the running process space. You can find the specific internal principles here: www.kernel.org/doc/Doc..., but the disadvantage of this method is that sending a SIGTSTP signal is not simple enough for the process to understand, so that it cannot Halt all processes.

docker rm

The docker rm command will remove the read-write layer that makes up the container. Note that this command can only be executed on non-running containers.

docker rmi

The docker rmi command removes a read-only layer that makes up the image. You can only use docker rmi to remove the top level layer (which can also be said to be a mirror). You can also use the -f parameter to force the removal of the middle read-only layer.

docker commit

The docker commit command converts the read-write layer of the container into a read-only layer, so Convert a container into an immutable image.

docker build

The docker build command is very interesting, it will execute multiple commands repeatedly.

We can see from the picture above that the build command obtains the image according to the FROM instruction in the Dockerfile file, and then repeatedly 1) run (create and start) , 2) Modify, 3) Commit. Each step in the loop generates a new layer, so many new layers are created.

docker exec

The docker exec command will execute a new process in the running container.

docker inspect or

The docker inspect command will extract the top level of the container or image metadata.

docker save

The docker save command will create a compressed image file, which can be stored on another host Used on Docker. Unlike the export command, this command saves metadata for each layer. This command only takes effect on images.

docker export

The docker export command creates a tar file and removes metadata and unnecessary Layer, integrates multiple layers into one layer, and only saves the content seen from the current unified perspective (Translator's Note: The container after expoxt is then imported into Docker, and only one image can be seen through the docker images –tree command; The image after saving is different, it can see the historical image of this image).

docker history

The docker history command recursively outputs the historical image of the specified image.

The above is the detailed content of What is the difference between containers and images in docker?. For more information, please follow other related articles on the PHP Chinese website!