- A Docker image is built up from a series of layers.
- Each layer represents an instruction in the image’s Dockerfile.
- All layers except the last one is read-only.
- To identify each layer separately, Layers are now identified by a digest, which takes the form algorithm:hex;
for example: sha256:fc92eec5cac70b0c324cec2933cd7db1c0eae7c9e2649e42d02e77eb6da0d15f - The hex element is calculated by applying the algorithm (SHA256) to a layer’s content. If the content changes, then the computed digest will also change.
- The image ID is also a digest, and is a computed SHA256 hash of the image configuration object, which contains the digests of the layers that contribute to the image’s filesystem definition.
- To ensure the container security a common piece of advice is to use SHA-256 hashes