Images, Tags, Digests and Registries

Key points

1. 1

   An image is a manifest that references a config blob and ordered layer blobs, all by SHA-256 digest. Identical content always has the same digest, which is how layers are shared and deduplicated.

2. 2

   Tags are mutable pointers. Deploy immutable per-build tags or, better, pin name@sha256:…; when a reference has both a tag and a digest, the digest wins.

3. 3

   Multi-platform tags point to an image index. Each host picks its own platform; --platform overrides that, and an index digest pins every platform at once.

4. 4

   Short names normalise to docker.io/library/NAME:latest. A first component containing . or :, or localhost, names a registry host.

5. 5

   docker save/load keep layers, config and tags; docker export/import produce one flat layer with no config. docker run pulls only when the image is missing locally.

6. 6

   Docker Hub limits pulls per 6 hours, counting anonymous pulls per IP and multi-arch pulls per architecture. Authenticate, use a mirror or pull-through cache, or copy base images into your own registry.

7. 7

   Base image choice is a trade-off: Alpine is tiny but uses musl; debian-slim and distroless use glibc; distroless and scratch drop the shell entirely.

Read the source

• Docker docs: What is an image?
• Docker docs: Multi-platform images
• Docker docs: Docker Hub pull usage and limits