What’s the difference between Docker images and containers?

Docker images and containers ensure that isolated environments can be started and that applications can be executed in them. This is why they are two of the most important components of the Docker virtualization platform and ecosystem. Here we explain what they are and look at the similarities and differences between the two.

Docker containers

Docker containers are isolated execution units for applications and their dependencies. In this respect, they are very similar to virtual machines (VMs), but there are some important differences. The main difference is the degree of isolation. Since no additional operating system need to be virtualized, the degree of isolation is slightly lower for containers when compared with virtual machines. Instead, containers share the operating system and core of the host system. This offers some advantages that facilitate and accelerate application development, but it also comes with a few disadvantages.

Containers consume fewer resources than virtual machines do. As a result, they perform better and can be started more quickly. They are also significantly more portable than virtual machines, as only the application that will be executed and its dependencies need to be transported. The low overhead of Docker containers also makes it possible to execute several containers on the same system simultaneously.

One disadvantage of this lower level of isolation is that containers have poorer security compared to virtual machines. Since all containers have access to the operating system kernel, an infected container could cause serious damage. This is why a VM should be used for applications that require a higher level of security.

Docker images

A Docker image is a read-only template that is used by the Docker engine to create a container. This means that Docker containers can be viewed as running instances of Docker images. The template contains the dependencies of the application to be executed, the required runtime environment and the application code itself. As a template for containers, images are used to create consistent, reproducible execution environments for applications.

Docker images themselves are stored as binary files but can also be stored in human-readable form. These text-based files are called Dockerfiles and contain all the instructions needed to restore the image.

Both Docker images and Dockerfiles are portable and can be transported easily from system to system. This means that Docker images can be stored in Docker registry repositories such as Docker Hub and downloaded from there. Running container instances can also be saved as image files using the Docker command docker commit.

What is the difference between a Docker image and container?

Docker images and containers are basically the same thing, just in different forms. An image is a read-only template for a container that contains all the necessary files, dependencies and runtime environments for executing an application, as well as the application itself. A container, on the other hand, is a running, non-read-only instance of this image file, just as a running program is an instance of the program files installed on a hard disk.

This means that an image is a binary file that is stored in the file system of the host computer and a container is a running process that is located in the system’s RAM. Just as a Docker image is used to create a Docker container, a running container can also be saved as an image. This, in turn, can be used to create an exact replication of the same container.