Docker Images Explained: Pull, List, Tag and Remove

An image is a read-only template for containers. It contains a small file system with an app and its libraries, plus settings such as which command to run.

Image names#

python:3.13-slim
  |      |
  |      +-- tag: a version or variant
  +--------- repository: the name

ghcr.io/your-name/app:1.2.0
   |        |     |     |
   |        |     |     +-- tag
   |        |     +-------- image name
   |        +-------------- account
   +----------------------- registry

Without a registry, Docker uses Docker Hub. Without a tag, it uses latest.

Pull and list#

docker pull downloads an image without running it:

docker pull -q alpine:3.24
docker pull -q python:3.13-slim
docker pull -q python:3.13-alpine
docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.Size}}'

docker.io/library/alpine:3.24
docker.io/library/python:3.13-slim
docker.io/library/python:3.13-alpine
REPOSITORY   TAG           SIZE
python       3.13-slim     118MB
python       3.13-alpine   45.7MB
alpine       3.24          8.42MB

Choosing a variant#

Official images come in several flavours:

Smaller images download faster and contain less that can be attacked.

Inspect an image#

docker inspect shows an image's settings. --format picks out a value:

docker inspect --format '{{.Os}}/{{.Architecture}}' alpine:3.24
docker inspect --format '{{json .Config.Cmd}}' python:3.13-slim

linux/amd64
["python3"]

Cmd is the command that runs by default, which is why a plain docker run python:3.13-slim would start Python.

Layers#

An image is built from layers. Each one records a change to the file system, and images that share a base also share its layers on disk:

docker history --format '{{.Size}}\t{{.CreatedBy}}' alpine:3.24 | cut -c1-60

0B	CMD ["/bin/sh"]
8.42MB	ADD alpine-minirootfs-3.24.3-x86_64.tar.gz /…

You will see why this matters in Layers, Cache and .dockerignore.

Running an image with another command#

docker run --rm python:3.13-slim python -c "print(sum(range(101)))"

5050

You did not install Python on your computer. This is useful for trying a tool or a version without installing it.

Tag an image#

docker tag gives an image another name. No data is copied, and both names have the same ID:

docker tag alpine:3.24 my-base:1.0
docker images --format '{{.Repository}}:{{.Tag}} {{.ID}}' | grep -E 'alpine:3.24|my-base'

alpine:3.24 b92841763c5c
my-base:1.0 b92841763c5c

Remove images#

docker rmi my-base:1.0
docker image prune -f

Untagged: my-base:1.0
Total reclaimed space: 0B

docker rmi removes a name, and deletes the image if no names are left. docker image prune removes "dangling" images, which have no name. Add -a to remove all images not used by a container.

Check how much space Docker is using:

docker system df --format 'table {{.Type}}\t{{.TotalCount}}\t{{.Size}}' | head -n 3

TYPE            TOTAL     SIZE
Images          3         164MB
Containers      0         0B

docker system prune removes stopped containers, unused networks, and dangling images. It asks you to confirm first.

Finding images#

Search on hub.docker.com. Prefer Docker Official Images and Verified Publishers. Anyone can publish an image, so treat others with care, as you would any program from the internet.

Common mistakes#

Practice#

docker pull -q redis:8.6-alpine
docker images redis --format '{{.Size}}'
docker inspect --format '{{json .Config.Cmd}}' redis:8.6-alpine

docker.io/library/redis:8.6-alpine
98.1MB
["redis-server"]

Key takeaway#

Next: Managing Containers.