What are Docker images none: none?

I bring to your attention the translation of the article What are Docker none: none images? from the Project Atomic blog.

The last few days I spent on exercises with Docker images <none>:<none> . To explain what they are, and what they can do, I write this post in which I pose questions:

1. What are Docker images <none>:<none> ?
2. What are dangling images?
3. Why do I see a bunch of images <none>:<none> when I do docker images -a ?
4. What is the difference between docker images and docker images -a ?

Before I start answering questions, remember that there are two kinds of <none>:<none> images <none>:<none> : good and bad.

Good images <none>: <none>

To understand them, you need to understand how the Docker image file system works, and how the image layers are organized. This post will use the Fedora image as an example. The docker daemon is running on a laptop, and I'm going to download a fedora image from a docker hub.

In this screenshot, docker images shows fedora:latest , and docker images -a already has two fedora:latest and <none>:<none> . If you use Docker, you noticed that the number of images <none>:<none> grows exponentially with the number of loaded images.

What are the <none>:<none> images for? To understand this, you need to know how the Docker file system layers are organized. Each docker image consists of layers, and the layers have parent and child relationships with other layers. All layers of the docker file system are stored in /var/lib/docker/graph by default. In Docker terminology, it is called a graph database. In the example, fedora:latest consists of two layers, which can be found in /var/lib/docker/graph .

IMAGE ID corresponds to the layer in the /var/lib/docker/graph directory. When you do docker pull fedora , the image loads one layer at a time. First, the docker loads the 48ecf305d2cf layer and marks it <none>:<none> , as this is just one of the layers of the fedora:latest image. In Docker terminology, it is called intermediate because of the -a option.

Next, Docker loads the ded7cd95e059 layer and marks it with fedora:latest . The fedora: latest image consists of these two layers, forming the parent-child relationship.

To check the existence of a parent-child connection, we can check the JSON file of the ded7cd95e059 layer.

That's right! Now we understand what the <none>:<none> images mean. These are intermediate images that can be seen using docker images -a . They do not overflow the hard drive, but take up a lot of space in the command output. And quite difficult to understand what they are.

We responded to (1), (3) and (4). Let's shed some light on (2).

Bad <none>: <none>

Other images <none>:<none> are separate images that can overflow the hard disk.

In Java and Golang programming languages, a separate memory block is a block without references from anywhere in the code. The garbage collection system of such languages ​​periodically marks the blocks as separate and returns them to the heap, after which these blocks are available for future use. Like them, a separate Docker file system layer is something that is unused and has no references from any images. Therefore, we need a way to tell Docker to clean up these separate images.

We already know what <none>:<none> in docker images -a means. It is said above that these are intermediate images. However, in the absence of images <none>:<none> in the docker images output, there are intermediate images available for cleaning. Where do they come from?

These intermediate images are the results of the docker build or pull commands. As a concrete example,

Let's hello_world image using our previously downloaded basic fedora image. We will hello_world image using a Dockerfile.

As shown in the top screenshot, we successfully compiled the image of hello_world using the Dockerfile.

Time passed after the assembly of the image hello_world , and a new version of Fedora was released. Let's download the new Fedora image.

I got a new Fedora look. Now I want to build a hello_world image with the new Fedora. Let's build the image again with the same Dockerfile.

If you digress and check, the old Fedora image has an IMAGE ID ( ded7cd95e059 ) and the new Fedora image from the screenshot above has an IMAGE ID ( 5c6d07393f9f ), which means that the Fedora image has been successfully updated. The important thing to note on the top screenshot is the image of <none>:<none> .

If you remember, the <none>:<none> docker images -a specified in docker images -a are intermediate (good) images, but this image <none>:<none> is the usual docker image. This is a separate image and must be cleaned. When the hello_world image was hello_world using the Dockerfile, its link to the old Fedora became unmarked and detached.

This command can be used to clean isolated images.

 docker rmi $(docker images -f "dangling=true" -q) 

Now Docker does not have an automatic garbage collection system. It will be cool to have one. In the meantime, this command can be used for manual garbage collection.