Images and tags

What you will be able to do

• Pull an image by tag and list it with docker images
• Explain what a tag is and why latest moves
• Remove an image you no longer need

Why this matters for DE and AI

postgres:latest on Monday is not postgres:latest in six months. Pinning postgres:16-alpine (or a digest) is how a warehouse job stays reproducible. The same rule will apply to Python base images later.

Concepts

An image reference looks like:

[registry/]repository:tag

Piece	Example	Meaning
registry	docker.io (default)	Where to download from
repository	alpine or library/postgres	The image name
tag	3.20, 16-alpine	A pointer to one build

Docker Hub (docker.io) is the default registry. Official images live under short names (alpine, postgres, nginx).

docker pull IMAGE downloads (or updates) the image without running it. docker run will pull if the image is missing.

latest is just a tag that maintainers move. It is not a promise. In this module we pin versions: alpine:3.20, nginx:alpine (we will still prefer a dated tag when we care), postgres:16-alpine.

Alpine variants are smaller. postgres:16-alpine is the database plus a small userland — good for a laptop lab. The non-alpine postgres:16 is larger and closer to some production images.

Image ID (hex) is the real object. Two tags can point at the same ID.

docker images
docker rmi IMAGE

rmi removes an image. It fails if a container (even stopped) still references it — rm the container first.

Practice on your machine

cd ~/dcubes/docker-lab
docker pull alpine:3.20

What you should see: layers already present (you used this image) or a short download. A digest line (sha256:…) identifies the build.

docker images alpine

At least alpine with tag 3.20 and a size of a few MB.

Pull the nginx image we will use for ports. This is larger than Alpine; wait for it.

docker pull nginx:1.27-alpine
docker images nginx

What you should see: nginx 1.27-alpine and a size on the order of tens of MB, not hundreds.

Print the ID:

docker images -q nginx:1.27-alpine

A short hex string.

You do not need to log in to Hub for public official images. docker login is for private registries; skip it here.

If you want the disk back after this lesson, you may remove nginx until the ports lesson. Optional:

docker rmi nginx:1.27-alpine

If it says the image is in use, a container still exists: docker ps -a and docker rm that name first. We will pull nginx again in lesson 9.

Leave alpine:3.20 installed.

Common mistakes

• Shipping image: python:latest in a pipeline. Pin a version tag.
• Assuming pull always gets something new. If you already have the tag, pull may no-op until the tag moves on Hub.
• Deleting images to “fix” a crash. Read docker logs first. The image is usually fine; the command, env, or volume is not.

Next

Write a Dockerfile — FROM, COPY, CMD, and docker build.