Understanding Docker Container Image Format

Author

Govardhana M K
September 16, 2025

TechOps Examples

Hey — It's Govardhana MK 👋

Welcome to another technical edition.

Every Tuesday – You’ll receive a free edition with a byte-size use case, remote job opportunities, top news, tools, and articles.

Every Thursday and Saturday – You’ll receive a special edition with a deep dive use case, remote job opportunities and articles.

👋 Before we begin, I’m happy to share a free practical playbook to sharpen your Kubernetes skills.

You've deployed your Kubernetes cluster. Everything runs. But under the hood? 

You're probably burning thousands on unused compute.

In fact, data shows that 51% of Kubernetes cloud spend is wasted, and 25% of clusters are at risk from misconfigured workloads.

That’s why we created the Kubernetes Optimization Playbook, a free, practical, industry-tested ebook for DevOps professionals who want to simplify Kubernetes optimization and eliminate cloud waste.

⤷ How to assess and eliminate resource risks.
⤷ How to rightsize your pods.
⤷ How to eliminate idle node waste.
⤷ How to use cost-effective instance types.
⤷ When to automate K8s optimization.

BONUS: at the end, there’s a 6-step framework + a Production-Ready Optimization Assessment you’ll want to run your cluster through.

If you’re not a subscriber, here’s what you missed last week.

To receive all the full articles and support TechOps Examples, consider subscribing:

IN TODAY'S EDITION

🧠 Use Case

  • Understanding Docker Container Image Format

👀 Remote Jobs

📚️ Resources

🛠️ TOOL OF THE DAY

KubeForge - Visual Editor for Kubernetes Deployments.

A visual first toolkit that simplifies the process of building, validating, and managing Kubernetes deployment configurations.

🧠 USE CASE

Understanding Docker Container Image Format

You run docker pull and typically you see the image downloading in seconds.

$ docker pull python:latest
latest: Pulling from library/python
aad63a933944: Pull complete
fbd2732ad777: Pull complete
2d473b07cdd5: Pull complete
a8a91b9c15e9: Pull complete
b10cf8d7e75f: Pull complete
Digest: sha256:08a0ddc21f9ef2fb4d0e0e0baf4e93f3e4e8ff74c8a7bda14f74ef9e3a735247
Status: Downloaded newer image for python:latest

It feels simple, but how is the container image formatted??

Breaking Down the Container Image Format

When you pull an image, the full name is a structured format that tells Docker exactly where to go and what to fetch. Take this example:

  • Domain: ghcr.io
    This defines the registry. Docker uses this to know which service to contact. It could be Docker Hub, GitHub Container Registry, AWS ECR, or any other registry.

  • Path: techops/labs/app
    This is the repository inside the registry. It organizes and groups related images together.

  • Tag: latest
    This is a mutable identifier. It points to a specific image but can change over time when new versions are pushed. Tags like v1.2.3 are more stable, while latest is a moving pointer.

  • Digest: sha256:...
    This is an immutable identifier. It is a cryptographic hash of the exact image content. Once published, it never changes. Using a digest ensures you always get the same build.

Together, the tag and digest define a build. The tag makes it easy to reference and update, while the digest guarantees reproducibility.

❝

tag and digest decides whether your environment stays predictable or risks pulling a different binary tomorrow.

That is why many teams use tags for development and digests for production.

Popular Image Registries

The popular image registries you may come across in day to day work are mostly tied to the ecosystem you operate in.

Docker Hub → Most used for public images and community projects

GitHub Container Registry (works only as a registry endpoint, no UI) → Used when code and containers live together

Red Hat Quay → Common in Red Hat and OpenShift environments

AWS ECR Public → Natural choice for AWS workloads

Microsoft Artifact Registry → Official images for Windows and dev tools

Practical Nuances

  • Tags change, digests don’t. Use digests in production.

  • Use the registry closest to your workloads for speed and cost.

  • GHCR images are private by default, Docker Hub public by default.

  • Authentication is not uniform. Docker Hub can be used anonymously for public pulls, GHCR requires tokens for almost everything, and AWS ECR relies on IAM.

🔴 Get my DevOps & Kubernetes ebooks! (free for Premium Club and Personal Tier newsletter subscribers)

Looking to promote your company, product, service, or event to 52,000+ DevOps and Cloud Professionals? Let's work together.