Container Image

Go to Terms and Definitions

Discussion

A Container Image is an immutable Image Artifact that packages the files, software, configuration, and metadata required to instantiate a containerized workload.

A Container Image may contain:

Application filesExecutable softwareRuntime librariesOperating-system filesConfiguration filesEnvironment defaultsStartup instructionsDependency informationImage metadataOne or more filesystem layersA container runtime uses a Container Image to create one or more container instances.

Multiple container instances may originate from the same Container Image while maintaining separate runtime state.

A Container Image differs from a container:

A Container Image is the immutable image Artifact used to create a containerA container is a runtime instance created from a Container ImageA Container Image differs from a Machine Image:

A Container Image packages the content required to instantiate a containerized workload within a container runtimeA Machine Image packages the content required to instantiate a virtual machineA Container Image may use layered content. A change to image content produces a new Container Image rather than modifying an existing immutable image in place.

A Container Image may participate in:

Image buildingImage signingImage verificationCompliance assessmentImage promotionRepository publicationOffline transferContainerized-workload deployment

Definition

immutable image artifact that packages the files, software, configuration, and metadata required to instantiate a containerized workload

Source

Dido Solutions, Inc. and Jackrabbit Consulting, Inc.

Note

A Container Image may be identified by:

A repository nameA tagA content digestA Revision identifierA release identifierA combination of these identifiersA mutable tag does not make the referenced Container Image mutable. A tag may be reassigned to another Container Image, while each content-addressed image remains distinguishable by its digest.

A Container Image does not by itself establish that the image is:

ApprovedSignedVerifiedFree from vulnerabilitiesCompliant with an applicable BaselineAuthorized for deploymentCompatible with a particular container runtimeSuitable for a specified purposeSeparate requirements govern those determinations.

The term does not prescribe a particular image format, container runtime, image registry, orchestration platform, operating system, or provider implementation.

Example

Crucible builds a Container Image containing an application, its runtime libraries, configuration defaults, startup instructions, and identifying metadata. A container runtime later uses the Container Image to instantiate multiple containerized workloads.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.