Almost every beginner's Docker confusion comes down to these three words being used interchangeably as if they meant the same thing. Once you've got the difference down, every Docker command suddenly makes sense.
Image — a read-only template, like a master mold
An image is a package containing everything an app needs to run: code, runtime, libraries, default configuration. It is read-only — once built, its contents never change.
Think of an image as a master cake mold. The mold itself never gets "eaten" — it's only used for casting.
docker pull nginx # fetch the nginx image from the registry
docker image ls # list the images on your machine
Container — a live instance of an image (many from one image)
A container is a running process created from an image — the cake that came out of the mold. From a single image you can run many containers at once, each isolated and living its own life.
docker run --name web1 -d nginx # first container from the nginx image
docker run --name web2 -d nginx # second container — same image
Key thing to remember: changes made inside a container (files you create, etc.) never modify the image. Delete the container and those changes are gone — the image stays intact.
Registry & Docker Hub — where images live and get shared
A registry is an online warehouse where images are stored and shared. The most famous one: Docker Hub (hub.docker.com) — home of official images like nginx, postgres, node, plus millions of public community images.
Inside a registry, images are grouped into repositories (e.g. nginx), and each repository holds multiple version tags (e.g. nginx:1.27, nginx:alpine) — details in Module 7.
The full flow: pull → run → (later) push
flowchart LR
HUB["Registry<br/>(Docker Hub)"] -- "docker pull" --> IMG["Image<br/>(read-only template)"]
IMG -- "docker run" --> C1["Container 1"]
IMG -- "docker run" --> C2["Container 2"]
MINE["Your own image"] -- "docker push" --> HUB
docker pullfetches an image from the registry to your machine.docker runcreates a live container from that image.docker push(Part C) sends your own image to a registry so others can use it.
Quick comparison
| Image | Container | Registry | |
|---|---|---|---|
| What it is | Read-only template | Live instance of an image | Online image warehouse |
| Analogy | Master mold | The cake it casts | The mold warehouse |
| Typical commands | pull, build, push |
run, ps, stop, rm |
login, search |
Summary
- An image = a read-only template holding an app + its dependencies; it never changes.
- A container = a live process created from an image; one image can spawn many containers.
- A registry (Docker Hub) = the online warehouse where images are stored & shared.
- The flow: pull (fetch an image) → run (start a container) → later push (share your own image).
Next, we install Docker on your machine and make sure everything works with a first test.