Where a Container's Writes Actually Go

A container can write anywhere its process has permission to, and none of it lands in the image. The image is read-only, and it stays that way while every container started from it edits whatever it likes.

The writes go into the container's own writable layer: a thin scratch space stacked on top of the image's layers. Reads fall through to the image; writes stop at the top.

That layer is created with the container and destroyed with it. It is not a cache and not a disk — it is part of the container, and it has exactly the container's lifetime.

So anything you want to keep has to be put somewhere that is not the container, which is what mounts are for.