Container image
A container image is a read-only, portable package that holds an application, its libraries and a minimal filesystem, plus metadata such as the command to run. A runtime like containerd starts containers from it. Most images today follow the Open Container Initiative (OCI) image format, so one image runs under Docker, Kubernetes and other runtimes.
How it works
An image is a stack of layers, one per build step, described by a manifest. Each layer is identified by a SHA-256 digest, so identical layers are shared and cached. A tag such as api:1.4.2 is a movable name, while a digest such as api@sha256:... always points at the same bytes. Multi-stage builds compile in one stage and copy only the binary into a small runtime stage. One2N cut one image from about 2 GB to 600 MB this way. At 100 MB per second, that is a pull of 6 seconds instead of 20 on every new node.
Why it matters in production
Image size sets how fast new pods start, which decides how fast autoscaling reacts. Pinning by digest makes deployments reproducible and rollbacks exact. Every package in the image is also attack surface, so smaller images mean fewer known vulnerabilities (CVEs) to patch.
See also
On the One2N blog
Further reading
