Why Does Docker Run in Layers?

2024-04-18T00:00:00Z

If you have ever spun up a container on a fresh machine, you have probably stared at a terminal output that looks something like this:

$ docker run -d -p 80:80 nginx
Unable to find image 'nginx:latest' locally
latest: Pulling from library/nginx
7a5d12f3b9e4: Pull complete
9b3a721c5d80: Pull complete
5f410298a12e: Pull complete
d29a50e1837b: Pull complete
Digest: sha256:4d6423984534a742876...
Status: Downloaded newer image for nginx:latest

Instead of downloading a single neat installer like nginx.iso or nginx.zip, Docker pulls a cascade of distinct cryptographic hashes, each extracting its own slice of files in parallel.

Why does Docker do this? Why not just hand you one monolithic virtual disk and call it a day?

The answer lies in layered filesystems and how the container lifecycle manages changes from build time to runtime.

What Actually Is a Docker Layer?

Think of a Docker image not as a heavy virtual hard drive, but as a stack of semi-transparent tracing paper sheets.

Each layer represents an immutable snapshot of changes (added files, modified configs, or deleted binaries) introduced by a specific instruction in your Dockerfile:

FROM python:3.11-slim           # Layer 1: Base Debian rootfs + Python binary
WORKDIR /app                   # Layer 2: Working directory metadata
COPY requirements.txt .        # Layer 3: Dependency manifest
RUN pip install -r requirements.txt  # Layer 4: Installed packages
COPY . .                       # Layer 5: Your actual application code

When Docker builds this image:

It executes FROM python:3.11-slim, pulling the pre-built base OS layer.
It executes WORKDIR /app, noting that directory state as an incremental layer.
It copies requirements.txt as another layer.
It runs pip install, creating a layer containing just the downloaded libraries.
It copies your source code as the final layer.

Every layer is stored as a compressed tarball identified by its SHA-256 hash. Once created, an image layer is 100% read-only and immutable. It never mutates.

The Glue: Union Filesystems and OverlayFS

How does Linux turn four or five stacked folders into what looks like a standard unified Linux root filesystem (/) inside your container?

Docker uses a storage driver mechanism known as a Union File System (most commonly OverlayFS):

Lower Directories (lowerdir): The stack of read-only image layers.
Merged Directory (mergeddir): The unified virtual view presented to your running processes.

If Layer 1 contains /etc/nginx/nginx.conf and Layer 4 replaces /etc/nginx/nginx.conf with a custom configuration, OverlayFS merges them such that the file in the higher layer hides the file in the lower layer. To your process running inside the container, there is only one /etc/nginx/nginx.conf.

The Container Lifecycle: Where Does My Data Go?

When you type docker run, Docker does not make a full copy of the 500 MB image. If it did, spinning up ten containers would take minutes and consume gigabytes of disk space.

Instead, Docker goes through a four-stage filesystem lifecycle:

[ Container Process View: /mergeddir ]
                 ▲
                 │
┌────────────────┴────────────────┐
│  Thin Read-Write Container Layer │  ◄── Added on "docker run" (ephemeral)
├─────────────────────────────────┤
│  Layer 5: Application Source    │  (read-only)
├─────────────────────────────────┤
│  Layer 4: Installed Packages    │  (read-only)
├─────────────────────────────────┤
│  Layer 3: Dependency Manifest   │  (read-only)
├─────────────────────────────────┤
│  Layer 1: Base Linux OS         │  (read-only)
└─────────────────────────────────┘

1. Ignition: Slapping on the Writable Layer

When the container starts, Docker mounts the entire stack of image layers as read-only, and attaches one very thin read-write layer (often called the container layer or upperdir) directly on top.

2. Copy-on-Write (CoW) in Action

Reading files: If your web server reads static assets, it reads directly down through the read-only image layers with zero overhead.
Modifying existing files: If a process writes to an existing file that belongs to an image layer, the storage driver intercepts the write, makes a duplicate of that file up into the writable container layer, and modifies the copy there. The original file in the lower image layer remains untouched.
Deleting files: If you run rm /app/config.json, Docker does not touch the read-only layer below. It creates a special whiteout character device in the writable layer that masks the lower file from view.

3. Container Stop (`docker stop`)

When the container stops, its read-write layer stays frozen on disk. You can inspect logs, check modified files, or start it back up (docker start) and pick up exactly where you left off.

4. Container Destruction (`docker rm`)

The moment you delete the container with docker rm, Docker simply unlinks and deletes that single, thin read-write layer. The underlying image layers stay untouched in the local cache, ready to power twenty other containers instantly.

Why This Architecture is a Game-Changer

Storage Deduplication: If you run ten instances of an API container based on python:3.11-slim, that 150 MB base layer exists on your host disk exactly once. Ten running containers consume 150 MB total, plus a few megabytes of writable scratch space.
Lightning-Fast Builds via Layer Caching: If you edit one line of code in app.py, Docker realizes that layers 1 through 4 have not changed. It fetches them from cache in milliseconds and only rebuilds layer 5.
Network Bandwidth Savings: When you push version 1.2.0 of your microservice to an AWS ECR or Docker Hub registry, your CI/CD runner only uploads the 3 MB layer containing your new code, completely skipping the unchanged 300 MB operating system and library layers.

Key Takeaways for Production Dockerfiles

Order from least-frequent to most-frequent changes: Place OS package installs (apt-get) and dependency resolutions (npm install, pip install) above your application source code (COPY . .). That way, editing application code never invalidates your dependency cache.
Chain commands to keep layers lean: Each RUN creates a layer. Cleaning up package caches in a subsequent RUN step does not reduce the image size because the previous layer is already committed. Always run cleanup in the same step: apt-get update && apt-get install -y nginx && rm -rf /var/lib/apt/lists/*.
Use Multi-Stage Builds: Compile your binaries in a bloated build-stage layer, and COPY only the final stripped executable into a clean, minimal scratch or distroless runtime layer.

Starting with Go Programming

2024-03-05T00:00:00Z

Go (often called Golang) is Google's open-source programming language designed for scalable, concurrent network servers and distributed cloud systems. It is statically typed, natively compiled, and deliberately minimalist.

Why Go is the Language of the Cloud

Most modern infrastructure software—including Kubernetes, Docker, Terraform, and Prometheus—is written in Go. The reasons are practical:

Lightweight Concurrency: Goroutines and channels make concurrent programming lightweight and efficient, consuming only kilobytes of stack memory per goroutine.
Fast Compilation & Single Binaries: Compiles directly to native machine code without virtual machine overhead or external runtime dependencies.
Orthogonal Simplicity: Minimalist syntax that eliminates unnecessary object-oriented bloat, favoring composition and explicit error handling.

Hello World

package main

import "fmt"

func main() {
    fmt.Println("Hello, World!")
}

Essential Learning Resources

To get started building production-grade services:

A Tour of Go — Interactive browser-based walkthrough of language fundamentals.
Effective Go — The definitive style and architectural guide from the Go core team.
Go Packages (pkg.go.dev) — Central documentation index for the standard library and open-source packages.

What the heck is Ansible anyways?

2024-02-10T00:00:00Z

Ansible is an open-source IT automation engine, or as I like to call it, "the thing that saves you from typing the same commands across 50 servers."

Why Use Ansible?

Agentless: No background daemons or custom agents required on target nodes. It orchestrates over standard SSH on Linux and WinRM on Windows.
Declarative & Idempotent: Playbooks describe desired system state rather than sequential commands; re-running tasks does not mutate already-configured resources.
Human-Readable YAML: Tasks and roles are organized using clear YAML syntax that acts as living infrastructure documentation.

Code Example: Deploying Nginx

Here is a standard idempotent task to install and configure an Nginx web server:

- name: Install Nginx web server
  apt:
    name: nginx
    state: present
    update_cache: yes

- name: Ensure Nginx is running and enabled
  service:
    name: nginx
    state: started
    enabled: yes

Documentation & Community Ecosystem

To learn more about automating your infrastructure:

Ansible Getting Started Guide — Official documentation and core concepts.
Ansible Galaxy — Public hub for discovering and sharing community-maintained roles and collections.

Welcome to YahyaOnCloud

2024-01-15T00:00:00Z

Welcome to the official launch post for YahyaOnCloud! This site serves as my technical notebook, engineering portfolio, and space for publishing deep dives on distributed systems, perimeter networking, and cloud architecture.

What to Expect

Cloud Architecture: Practical teardowns of production AWS, Azure, and hybrid infrastructure topologies.
Systems Engineering & Security: Real-world security operations, intrusion detection engineering, and perimeter defense as explored in projects like the SOC Homelab.
Tooling & Cryptography: Implementation guides spanning Go, Ansible, and zero-knowledge storage like Firewood.
Operational Runbooks: Hard-won lessons operating high-traffic platforms, optimizing cloud economics, and reducing MTTR.

Explore the Site

Browse featured engineering case studies in Projects.
Review my career timeline in Experience and grab a copy of my Resume.
Follow open-source developments directly on GitHub.

yahyaoncloud

Why Does Docker Run in Layers?

What Actually Is a Docker Layer?

The Glue: Union Filesystems and OverlayFS

The Container Lifecycle: Where Does My Data Go?

1. Ignition: Slapping on the Writable Layer

2. Copy-on-Write (CoW) in Action

3. Container Stop (`docker stop`)

4. Container Destruction (`docker rm`)

Why This Architecture is a Game-Changer

Key Takeaways for Production Dockerfiles

Further Reading

Starting with Go Programming

Why Go is the Language of the Cloud

Hello World

Essential Learning Resources

What the heck is Ansible anyways?

Why Use Ansible?

Code Example: Deploying Nginx

Documentation & Community Ecosystem

Welcome to YahyaOnCloud

What to Expect

Explore the Site

yahyaoncloud

Why Does Docker Run in Layers?

What Actually Is a Docker Layer?

The Glue: Union Filesystems and OverlayFS

The Container Lifecycle: Where Does My Data Go?

1. Ignition: Slapping on the Writable Layer

2. Copy-on-Write (CoW) in Action

3. Container Stop (docker stop)

4. Container Destruction (docker rm)

Why This Architecture is a Game-Changer

Key Takeaways for Production Dockerfiles

Further Reading

Starting with Go Programming

Why Go is the Language of the Cloud

Hello World

Essential Learning Resources

What the heck is Ansible anyways?

Why Use Ansible?

Code Example: Deploying Nginx

Documentation & Community Ecosystem

Welcome to YahyaOnCloud

What to Expect

Explore the Site

3. Container Stop (`docker stop`)

4. Container Destruction (`docker rm`)