Container Images Explained: Layers, Manifests, and Digests
An image is not a filesystem — it is an ordered list of layer diffs plus a manifest that says how to assemble them. This video traces the whole lifecycle: what docker build produces, how the registry stores blobs by content digest, how the runtime resolves the manifest on pull, and how the storage driver stacks layers into a union filesystem at run time. We also look at what makes images fat — COPY invalidation, cache busting, multi-stage builds — and how OCI descriptors and content-addressable storage guarantee that the image you build is the image that runs.
Topics covered:
- Layers, manifests, and the OCI image spec
- Content-addressable blobs and digests
- Union mounts and copy-on-write at run time
- Why layer order matters for rebuilds and pull speed
Related articles
Container Images Are Layered Filesystems
How OCI images use overlayfs, copy-on-write layers, and digests — and why layer order determines your build cache, pull time, and image size.
Containers Aren't Lightweight VMs
Namespaces, cgroups, seccomp, and the real isolation boundaries — what containers actually isolate and what they don't.
Vendor Lock-In Is a Cost Model
Egress fees, control-plane APIs, and data gravity — how cloud providers price switching costs, and how to compute the real cost of a migration.
More in Cloud & Infrastructure
Edge Computing Explained: Where Compute Actually Sits
What edge computing actually is — the compute tiers from device to far edge to cloud, latency and bandwidth budgets, and which workloads genuinely benefit.
DetailsContainer Orchestration Basics: API Server, Controllers, and Scheduler
Container orchestration from first principles — what the API server, controller manager, and scheduler actually do, with Kubernetes as the working example.
DetailsThe Cost of Distributed Systems: Coordination, Consistency, and Failure
What distributed systems actually cost — coordination, consistency, and failure taxes — quantified with quorum math, tail latency, and retry-storm dynamics.
DetailsDNS and Traffic Routing in the Cloud: From Resolver to Anycast
How DNS actually routes traffic in the cloud — record resolution, CDN anycast, geo routing, load balancer handoffs, and how TTLs shape your failover story.
DetailsMulti-Region Architecture: Active-Active, Failover, and Replication
The real mechanics of multi-region deployments — where writes land, how replication propagates, what failover flips, and the latency math that constrains every design.
DetailsObject Storage Under the Hood: PUT, GET, and Erasure Coding
What happens inside an object store — the PUT and GET paths, metadata partitions, erasure coding, and why object storage is eventually consistent.
DetailsAutoscaling Explained: The Controller Loop Behind Horizontal Scaling
How autoscaling actually works — the metrics window, desired-replica calculation, stabilization, and why naive CPU-based scaling oscillates under real load.
DetailsServerless Cold Starts, Measured: Where the Latency Actually Goes
Measured cold-start latency across Lambda, Cloud Functions, and container runtimes — what actually takes time and which optimizations genuinely reduce it.
DetailsKubernetes Scheduling Visualized: The Filter-Score Pipeline
What the Kubernetes scheduler actually does — how pending Pods become assigned to Nodes, the filter-then-score pipeline, and how taints and affinity shape placement.
DetailsDepth, delivered weekly
One technical dispatch a week — articles and episode notes before they go public.
One technical dispatch per week. No noise.