What an Image Holds and What a Container Adds

You pull an image once and run it ten times. Ten containers later the image is byte for byte what it was.

An image is a filesystem, frozen: a stack of read-only layers with no process, no address and no state. A container is that image plus two things the image never had — a thin writable layer on top of it, and a process running inside.

Everything the container writes lands in that top layer and nowhere else. This is why removing a container never touches the image, and why two containers started from the same image cannot see each other's files.