Docker images are a read-only template of the application stack bundle and they don't have any state associated with them. The Docker container is spun off from the Docker image and it adds a read-write layer on top of the static image layers. If we try to draw a comparison with the object-oriented programming paradigm, Docker images are typically classes, whereas Docker containers are objects (instances of the classes).

The Docker image defines the behavior of the Docker container such as what process to run when the container is started. In the previous chapter, when you invoked docker run hello-world, the Docker Engine launched a new container from the hello-world Docker image and it went on to output quite a lot of information on the screen. From this example, it is quite evident that Docker images are the basic building block for Docker containers and Docker images prescribe the behavior of Docker containers.

As clearly illustrated in the preceding figure, when the container is spun-off, a writeable (read-write) layer is added on top of the image in order to maintain the application state. There could be several read-only images beneath the container layer (writeable).