Containers, Images, and Registries

What you will be able to do

• Distinguish a running container from the image package used to create it.
• Trace an image reference through its registry and repository boundaries.
• Compare a movable tag with an immutable digest for image identity.
• Verify that a running container uses the intended image content and runtime settings.

01

Map the Container Delivery Chain

Connect a running container with its packaged image, registry location, repository name, and immutable digest before choosing what to run.

A support team must run a small status page from a shared registry and prove which image content created the local container without trusting a moving tag.

Keep the stored package, its location, its human-readable reference, its immutable identity, and the resulting process separate. This separation lets an operator explain both where software came from and what actually runs.

02

Container instance

A container is a runnable image instance with an isolated process, filesystem, network, and runtime configuration. This role answers one specific container-distribution question and keeps its own inspectable evidence.

Identify the container ID, image reference, command, and current state. Apply that action to the status-page case before pulling another package or starting a new process.

Respect this boundary: do not treat a container as a virtual machine with its own independent kernel. The observable result is specific: the running process is tied to one image and explicit runtime settings.

03

Container image

A container image packages files, binaries, libraries, and default configuration used to create containers. This role answers one specific container-distribution question and keeps its own inspectable evidence.

Inspect the image reference, platform, layers, and locally recorded identifier. Apply that action to the status-page case before pulling another package or starting a new process.

Respect this boundary: do not edit an image in place; create a new image when packaged content changes. The observable result is specific: the selected package contains the expected application and runtime dependencies.

04

Image registry

An image registry stores and distributes container images between authorized systems. This role answers one specific container-distribution question and keeps its own inspectable evidence.

Confirm the registry hostname, access boundary, and source before pulling. Apply that action to the status-page case before pulling another package or starting a new process.

Respect this boundary: do not assume an unqualified image name resolves to the intended registry. The observable result is specific: the image is retrieved from the approved registry endpoint.

05

Image repository

A repository groups related image versions under one name inside a registry. This role answers one specific container-distribution question and keeps its own inspectable evidence.

Separate the registry, namespace, repository, and version selector in the reference. Apply that action to the status-page case before pulling another package or starting a new process.

Respect this boundary: do not confuse the entire registry with one repository or one version tag. The observable result is specific: the reference resolves to the intended project collection.

06

Image digest

An image digest identifies immutable image content independently of a movable tag. This role answers one specific container-distribution question and keeps its own inspectable evidence.

Record and compare the digest returned for the pulled image. Apply that action to the status-page case before pulling another package or starting a new process.

Respect this boundary: do not use latest alone as proof that two systems received identical bytes. The observable result is specific: the local image matches the exact approved content identifier.

07

Trace One Image to a Running Container

Use one bounded operating decision: A support team must run a small status page from a shared registry and prove which image content created the local container without trusting a moving tag.

First, confirm the registry hostname, access boundary, and source before pulling. Then, separate the registry, namespace, repository, and version selector in the reference. These checks establish the remote source and the named collection before any runtime state exists.

Next, inspect the image reference, platform, layers, and locally recorded identifier. After that, record and compare the digest returned for the pulled image. Start the workload only when you can identify the container id, image reference, command, and current state.

08

Recap Before Practice and Prove

Container instance: A container is a runnable image instance with an isolated process, filesystem, network, and runtime configuration. In this case, identify the container id, image reference, command, and current state. Preserve the boundary: do not treat a container as a virtual machine with its own independent kernel.

Container image: A container image packages files, binaries, libraries, and default configuration used to create containers. In this case, inspect the image reference, platform, layers, and locally recorded identifier. Preserve the boundary: do not edit an image in place; create a new image when packaged content changes.

Image registry: An image registry stores and distributes container images between authorized systems. In this case, confirm the registry hostname, access boundary, and source before pulling. Preserve the boundary: do not assume an unqualified image name resolves to the intended registry.

Image repository: A repository groups related image versions under one name inside a registry. In this case, separate the registry, namespace, repository, and version selector in the reference. Preserve the boundary: do not confuse the entire registry with one repository or one version tag.

Image digest: An image digest identifies immutable image content independently of a movable tag. In this case, record and compare the digest returned for the pulled image. Preserve the boundary: do not use latest alone as proof that two systems received identical bytes.