Docker Image Management

This chapter will provide an in-depth explanation of Docker image management, including core operations such as image acquisition, building, tagging, distribution, and optimization.

Image Concepts Review

Image Layered Structure

Docker images use a Union File System, composed of multiple read-only layers:

┌─────────────────────────────────────┐
│     Application layer (writable)    │  ← Container runtime writable layer
├─────────────────────────────────────┤
│     Layer 4: Application files     │  ← Read-only layer
├─────────────────────────────────────┤
│     Layer 3: Application deps      │  ← Read-only layer
├─────────────────────────────────────┤
│     Layer 2: Runtime environment   │  ← Read-only layer
├─────────────────────────────────────┤
│     Layer 1: Base OS              │  ← Read-only layer (Base Image)
└─────────────────────────────────────┘

Image Identifiers

Each image has a unique identifier:

# Full format
[registry_host[:port]/]username/repository[:tag]

# Examples
docker.io/library/nginx:1.21.6          # Official image
docker.io/myuser/myapp:v1.0             # User image
registry.company.com:5000/team/app:latest # Private registry image

Image Acquisition Operations

Pull Images from Registries

# Pull latest version
docker pull nginx

# Pull specific version
docker pull nginx:1.21.6

# Pull specific architecture image
docker pull --platform linux/amd64 nginx:latest

# Pull from private registry
docker pull registry.company.com:5000/myapp:v1.0

# Pull all tags
docker pull -a nginx

# View pull progress
docker pull nginx:latest

Search Images

# Search official images
docker search nginx

# Limit search results
docker search --limit 10 nginx

# Show only official images
docker search --filter is-official=true nginx

# Filter by stars
docker search --filter stars=100 nginx

# Format output
docker search --format "table {{.Name}}\t{{.Description}}\t{{.Stars}}" nginx

Image Viewing Operations

List Local Images

# List all images
docker images
docker image ls

# Show image digests
docker images --digests

# Show only image IDs
docker images -q

# Show all images (including intermediate layers)
docker images -a

# Custom output format
docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# Filter images
docker images --filter "dangling=true"      # Dangling images
docker images --filter "before=nginx:latest" # Created before specified image
docker images --filter "since=nginx:latest"  # Created after specified image
docker images --filter "reference=nginx:*"   # Match name pattern

View Image Details

# View image detailed configuration
docker inspect nginx:latest

# Get specific information
docker inspect --format='{{.Config.Env}}' nginx:latest
docker inspect --format='{{.Architecture}}' nginx:latest
docker inspect --format='{{.Size}}' nginx:latest

# View image history
docker history nginx:latest

# Show detailed history
docker history --no-trunc nginx:latest

# View image layer information
docker image inspect --format='{{json .RootFS.Layers}}' nginx:latest

Image Tagging Operations

Tag Images

# Add new tag to image
docker tag nginx:latest myregistry/nginx:v1.0

# Tag as different versions
docker tag myapp:latest myapp:v1.0
docker tag myapp:latest myapp:stable

# Tag to private registry
docker tag myapp:latest registry.company.com:5000/myapp:v1.0

# View tagging results
docker images myapp

Rename Images

# Docker has no direct rename command, use tag and delete
# 1. Create new tag
docker tag old-name:tag new-name:tag

# 2. Delete old tag
docker rmi old-name:tag

# Example: rename image
docker tag myapp:old myapp:new
docker rmi myapp:old

Image Building Operations

Build Using Dockerfile

# Basic build command
docker build -t myapp:v1.0 .

# Specify Dockerfile path
docker build -f /path/to/Dockerfile -t myapp:v1.0 .

# Specify build context
docker build -t myapp:v1.0 /path/to/context

# Build from URL
docker build -t myapp:v1.0 https://github.com/user/repo.git

# Build from standard input
docker build -t myapp:v1.0 - < Dockerfile

# Build without cache
docker build --no-cache -t myapp:v1.0 .

# Specify build arguments
docker build --build-arg VERSION=1.0 -t myapp:v1.0 .

# Specify target stage (multi-stage build)
docker build --target production -t myapp:v1.0 .

# Set memory limit
docker build -m 1g -t myapp:v1.0 .

Build Example

Create a simple Node.js application image:

# Dockerfile
FROM node:16-alpine

# Set working directory
WORKDIR /app

# Copy package.json
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production

# Copy application code
COPY . .

# Expose port
EXPOSE 3000

# Set startup command
CMD ["npm", "start"]

# Build image
docker build -t mynode-app:v1.0 .

# Run container for testing
docker run -d -p 3000:3000 --name test-app mynode-app:v1.0

Image Import/Export

Export Images

# Export single image
docker save nginx:latest -o nginx.tar
docker save nginx:latest > nginx.tar

# Export multiple images
docker save nginx:latest ubuntu:20.04 -o images.tar

# Compressed export
docker save nginx:latest | gzip > nginx.tar.gz

# View export file size
ls -lh nginx.tar

Import Images

# Import image
docker load -i nginx.tar
docker load < nginx.tar

# Import compressed image
gunzip -c nginx.tar.gz | docker load

# Verify import result
docker images nginx

Commit Container to Image

# Create image from running container
docker commit container_name new_image:tag

# Add commit message
docker commit -m "Added new feature" -a "Author Name" container_name new_image:tag

# Specify configuration changes
docker commit --change='CMD ["nginx", "-g", "daemon off;"]' container_name new_image:tag

# Commit after pausing container
docker commit --pause=true container_name new_image:tag

Image Deletion Operations

Delete Images

# Delete single image
docker rmi nginx:latest

# Delete multiple images
docker rmi nginx:latest ubuntu:20.04

# Force delete image
docker rmi -f nginx:latest

# Delete all dangling images
docker image prune

# Delete all unused images
docker image prune -a

# Delete images older than specified time
docker image prune --filter "until=24h"

# Batch delete images
docker rmi $(docker images -q)
docker rmi $(docker images --filter "dangling=true" -q)

Clean Up Image Space

# View Docker disk usage
docker system df

# Detailed view of disk usage
docker system df -v

# Clean all unused resources
docker system prune

# Clean all resources (including unused images)
docker system prune -a

# Clean resources older than specified time
docker system prune --filter "until=72h"

# Force cleanup (no confirmation prompt)
docker system prune -f

Image Registry Operations

Login and Authentication

# Login to Docker Hub
docker login

# Login to private registry
docker login registry.company.com:5000

# Login with username and password
docker login -u username -p password registry.company.com:5000

# Read password from file
cat password.txt | docker login -u username --password-stdin

# View login information
cat ~/.docker/config.json

# Logout
docker logout
docker logout registry.company.com:5000

Push Images

# Push to Docker Hub
docker push myuser/myapp:v1.0

# Push to private registry
docker push registry.company.com:5000/myapp:v1.0

# Push all tags
docker push -a myuser/myapp

# View push progress
docker push myuser/myapp:v1.0

Private Registry Configuration

# Run local registry
docker run -d -p 5000:5000 --name registry registry:2

# Push to local registry
docker tag myapp:v1.0 localhost:5000/myapp:v1.0
docker push localhost:5000/myapp:v1.0

# Pull from local registry
docker pull localhost:5000/myapp:v1.0

# Configure insecure registry (/etc/docker/daemon.json)
{
  "insecure-registries": ["registry.company.com:5000"]
}

Image Optimization Techniques

Reduce Image Size

# 1. Use multi-stage builds
FROM node:16 AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:16-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]

# 2. Use .dockerignore file
# .dockerignore
node_modules
npm-debug.log
.git
.gitignore
README.md
.env
coverage
.nyc_output

# 3. Combine RUN instructions
RUN apt-get update && \
    apt-get install -y curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 4. Use lightweight base images
FROM alpine:3.14
FROM node:16-alpine
FROM python:3.9-slim

Image Security Optimization

# 1. Use non-root user
FROM node:16-alpine
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001
USER nextjs

# 2. Install only necessary packages
RUN apk add --no-cache curl

# 3. Set read-only root filesystem
FROM alpine:3.14
RUN adduser -D -s /bin/sh appuser
USER appuser
# Use --read-only flag at runtime

# 4. Scan image for vulnerabilities
docker scan myapp:v1.0

Build Cache Optimization

# 1. Optimize layer order (layers that change less go first)
FROM node:16-alpine
WORKDIR /app

# Copy dependency files first
COPY package*.json ./
RUN npm ci

# Copy application code later
COPY . .
RUN npm run build

# 2. Use BuildKit cache mounts
# syntax=docker/dockerfile:1
FROM node:16-alpine
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm \
    npm ci

# 3. Use external cache
docker buildx build --cache-from type=registry,ref=myapp:cache \
                   --cache-to type=registry,ref=myapp:cache \
                   -t myapp:v1.0 .

Image Analysis Tools

Analyze Images Using dive

# Install dive
curl -OL https://github.com/wagoodman/dive/releases/download/v0.10.0/dive_0.10.0_linux_amd64.deb
sudo apt install ./dive_0.10.0_linux_amd64.deb

# Analyze image
dive nginx:latest

# Analyze locally built image
dive myapp:v1.0

Optimize Images Using docker-slim

# Install docker-slim
curl -sL https://raw.githubusercontent.com/docker-slim/docker-slim/master/scripts/install-dockerslim.sh | sudo -E bash -

# Optimize image
docker-slim build --target nginx:latest --tag nginx:slim

# View optimization results
docker images nginx

Practice Exercises

Exercise 1: Build Python Web Application Image

# Dockerfile
FROM python:3.9-slim

# Set working directory
WORKDIR /app

# Install system dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends gcc && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Copy dependency files
COPY requirements.txt .

# Install Python dependencies
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Create non-root user
RUN useradd --create-home --shell /bin/bash app && \
    chown -R app:app /app
USER app

# Expose port
EXPOSE 8000

# Startup command
CMD ["python", "app.py"]

# Build image
docker build -t python-web:v1.0 .

# Run test
docker run -d -p 8000:8000 --name python-app python-web:v1.0

# View image size
docker images python-web:v1.0

Exercise 2: Multi-Stage Build Go Application

# Multi-stage build Dockerfile
# Build stage
FROM golang:1.19-alpine AS builder

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o main .

# Runtime stage
FROM alpine:3.16

RUN apk --no-cache add ca-certificates
WORKDIR /root/

# Copy binary from build stage
COPY --from=builder /app/main .

# Create non-root user
RUN adduser -D -s /bin/sh appuser
USER appuser

EXPOSE 8080
CMD ["./main"]

# Build image
docker build -t go-app:v1.0 .

# Compare image sizes
docker images go-app:v1.0
docker images golang:1.19-alpine

Chapter Summary

This chapter comprehensively introduced various aspects of Docker image management:

Key Points:

• Image acquisition: Pull, search, import images
• Image viewing: List, inspect, analyze images
• Image building: Build custom images using Dockerfile
• Image tagging: Version management and naming conventions
• Image distribution: Push to registries and private registry management
• Image optimization: Reduce size, improve security, optimize builds

Best Practices:

• Use specific image tags instead of latest
• Regularly clean up unused images
• Use multi-stage builds to reduce image size
• Follow image security best practices
• Reasonably utilize build cache

In the next chapter, we will learn about Docker data management, including volumes, bind mounts, and data persistence strategies.

Further Reading

• Docker Image Best Practices
• Dockerfile Best Practices
• Docker Image Security Scanning