Lesson 02 — Container Image Architecture
Learning Objectives
Section titled “Learning Objectives”By the end of this lesson, you will be able to:
- Understand what a container image is
- Learn how container images are built
- Understand image layers and Union File Systems
- Explore Dockerfile architecture
- Learn how container images are stored and distributed
- Understand how image architecture impacts security
- Apply enterprise container image best practices for Amazon EKS
Why This Matters
Section titled “Why This Matters”Every container running in Kubernetes starts from a container image.
The image contains everything required to run an application, including:
- Operating system libraries
- Runtime environment
- Application code
- Configuration
- Dependencies
- Startup commands
If the image is poorly designed or contains vulnerabilities, every container created from it inherits those security weaknesses.
Understanding container image architecture is the first step toward building secure Kubernetes workloads.
What is a Container Image?
Section titled “What is a Container Image?”A container image is an immutable package that contains everything an application needs to execute.
Unlike a virtual machine, a container image does not contain an entire operating system.
Instead, it shares the host kernel while packaging only the components required by the application.
Container Image
├── Base Operating System
├── Runtime
├── Libraries
├── Dependencies
├── Application Code
└── Startup ConfigurationOnce built, the image should never be modified.
Container Image vs Running Container
Section titled “Container Image vs Running Container”A container image is a template.
A running container is an instance of that template.
Container Image
↓
Container
↓
Running ApplicationThink of it like this:
- Image = Blueprint
- Container = Building constructed from the blueprint
One image can create thousands of identical containers.
Container Image Lifecycle
Section titled “Container Image Lifecycle”Developer
↓
Source Code
↓
Dockerfile
↓
Build Image
↓
Image Scan
↓
Container Registry
↓
Deploy
↓
Amazon EKS
↓
Running ContainerEvery stage should include security validation.
Anatomy of a Container Image
Section titled “Anatomy of a Container Image”A typical image contains several components.
Container Image
├── Base Image
├── Package Manager
├── Runtime
├── Application Dependencies
├── Application Files
├── Configuration
└── MetadataEach component contributes to the overall security posture.
Understanding Image Layers
Section titled “Understanding Image Layers”Container images are built using layers.
Each instruction in a Dockerfile creates a new layer.
Application Layer
──────────────
Dependencies
──────────────
Runtime
──────────────
Base ImageWhen Kubernetes starts a container, these layers are combined into a single filesystem.
Benefits of Layered Images
Section titled “Benefits of Layered Images”Layering provides several advantages.
- Faster image builds
- Efficient storage
- Layer reuse
- Faster downloads
- Reduced network usage
- Improved caching
If only the application code changes, Kubernetes reuses the existing lower layers.
Union File System
Section titled “Union File System”Container runtimes use a Union File System (UnionFS) to combine multiple layers into one virtual filesystem.
Application Layer
↓
Dependencies
↓
Runtime
↓
Base Image
↓
Unified Filesystem
↓
Running ContainerApplications see a single filesystem even though it is built from multiple layers.
Read-Only Image Layers
Section titled “Read-Only Image Layers”Image layers are read-only.
When a container starts:
Read-Only Image
↓
Writable Container Layer
↓
Running ApplicationThe writable layer exists only while the container is running.
Once the container is deleted, any changes in the writable layer are lost unless external storage is used.
Base Images
Section titled “Base Images”Every container image starts with a base image.
Examples include:
- Amazon Linux
- Alpine Linux
- Ubuntu
- Debian
- Distroless Images
The security of the base image directly affects every application built on top of it.
Choosing a Secure Base Image
Section titled “Choosing a Secure Base Image”Enterprise organizations prefer base images that are:
- Officially maintained
- Frequently updated
- Minimal
- Vulnerability scanned
- Digitally signed
- Supported by the vendor
Smaller images generally contain fewer packages and therefore a smaller attack surface.
Dockerfile Architecture
Section titled “Dockerfile Architecture”A Dockerfile defines how a container image is built.
Typical workflow:
Base Image
↓
Install Packages
↓
Copy Application
↓
Configure Runtime
↓
Define Startup Command
↓
Build ImageEvery instruction creates a new image layer.
Example Dockerfile
Section titled “Example Dockerfile”FROM amazonlinux:2023
WORKDIR /app
COPY . .
RUN yum install -y python3
RUN pip install -r requirements.txt
USER 1000
CMD ["python3", "app.py"]Notice that the application runs as a non-root user rather than the default root account.
Image Metadata
Section titled “Image Metadata”Every container image includes metadata such as:
- Image ID
- Digest
- Tags
- Labels
- Architecture
- Build information
Example:
Image
↓
Digest
↓
sha256:xxxxxxxxThe image digest uniquely identifies the exact image contents.
Image Tags vs Image Digests
Section titled “Image Tags vs Image Digests”| Image Tag | Image Digest |
|---|---|
| Human-readable | Cryptographic identifier |
| Can change | Immutable |
Example: v1.2 |
Example: sha256:abc123... |
| Convenient for developers | Best for production deployments |
Enterprise deployments often reference image digests to ensure the exact approved image is deployed.
Container Registry
Section titled “Container Registry”After an image is built, it is stored in a registry.
Developer
↓
Build Image
↓
Amazon ECR
↓
Amazon EKS
↓
ContainerAmazon Elastic Container Registry (Amazon ECR) is the recommended private registry for Amazon EKS.
Multi-Architecture Images
Section titled “Multi-Architecture Images”Modern container images can support multiple CPU architectures.
Example:
Image Manifest
├── AMD64
├── ARM64
└── Other ArchitecturesThe container runtime automatically pulls the correct image for the target node.
Image Architecture and Security
Section titled “Image Architecture and Security”Every additional package increases the attack surface.
Example:
Large Image
↓
More Packages
↓
More Vulnerabilities
↓
Higher RiskInstead:
Minimal Image
↓
Fewer Packages
↓
Smaller Attack Surface
↓
Lower RiskThis is why minimal base images are recommended for production workloads.
Amazon EKS Architecture
Section titled “Amazon EKS Architecture”Developer
↓
Git Repository
↓
Dockerfile
↓
Build Pipeline
↓
Image Scan
↓
Amazon ECR
↓
Amazon EKS
↓
Running ContainerContainer image architecture forms the foundation of every Kubernetes deployment.
Enterprise Example
Section titled “Enterprise Example”A global banking organization builds all production workloads using an enterprise image pipeline.
The pipeline automatically:
- Builds images from approved base images
- Removes unnecessary packages
- Scans for vulnerabilities
- Signs images
- Pushes approved images to Amazon ECR
- Rejects images that fail security policies
Application teams are prohibited from deploying public container images directly into production.
Every workload originates from an approved enterprise image.
Common Image Architecture Risks
Section titled “Common Image Architecture Risks”Cloud Security Engineers frequently identify:
- Large container images
- Outdated base images
- Unnecessary packages
- Images built as root
- Hardcoded secrets
- Missing metadata
- Public images without verification
- Excessive image layers
- Unpatched software
- Untrusted image sources
These weaknesses increase the likelihood of software supply chain attacks.
Enterprise Monitoring
Section titled “Enterprise Monitoring”Security teams should monitor:
- Base image updates
- Image build failures
- Image vulnerabilities
- Image digest changes
- Registry access logs
- Image signing validation
- Unauthorized image uploads
- CI/CD build events
- Image age
- Deployment source
Monitoring helps ensure only trusted images reach production.
Enterprise Implementation Strategy
Section titled “Enterprise Implementation Strategy”A recommended implementation roadmap:
Step 1
↓
Choose Approved Base Images
↓
Step 2
↓
Build Minimal Images
↓
Step 3
↓
Remove Unnecessary Packages
↓
Step 4
↓
Configure Non-Root User
↓
Step 5
↓
Scan Images
↓
Step 6
↓
Sign Images
↓
Step 7
↓
Store in Amazon ECR
↓
Step 8
↓
Deploy to Amazon EKS
↓
Step 9
↓
Continuously MonitorThis process reduces the attack surface while improving operational consistency.
Best Practices
Section titled “Best Practices”As a Kubernetes Security Engineer:
- Use trusted and officially maintained base images.
- Prefer minimal or distroless images where appropriate.
- Keep images small to reduce vulnerabilities.
- Avoid installing unnecessary packages.
- Configure images to run as non-root users.
- Reference images by digest in production.
- Store production images in private registries such as Amazon ECR.
- Scan and sign every image before deployment.
- Continuously update base images with security patches.
- Automate image validation within CI/CD pipelines.
Secure image architecture is the foundation of a secure software supply chain.
Real-World Scenario
Section titled “Real-World Scenario”A software company develops a new customer portal for Amazon EKS.
Initially, developers build the application using a large public Ubuntu image containing hundreds of unused packages.
During security scanning, the pipeline identifies multiple critical vulnerabilities inherited from the base image.
The team rebuilds the application using an approved minimal enterprise base image.
The new image:
- Removes unnecessary software
- Reduces the image size by more than half
- Contains significantly fewer vulnerabilities
- Runs as a non-root user
- Is digitally signed before being stored in Amazon ECR
When deployed, the application provides the same functionality while presenting a much smaller attack surface.
Key Takeaways
Section titled “Key Takeaways”After completing this lesson, you should understand:
- What a container image is
- How container images are built
- Image layers and Union File Systems
- Dockerfile architecture
- Image metadata, tags and digests
- Secure base image selection
- Amazon ECR image management
- Enterprise container image best practices
Container image architecture is the foundation of Kubernetes supply chain security. Well-designed images reduce vulnerabilities, improve consistency and support secure, repeatable deployments across Amazon EKS environments.
Knowledge Check
Section titled “Knowledge Check”Question 1
Section titled “Question 1”What is a container image?
- A. A running application
- B. An immutable package containing everything required to run an application
- C. A Kubernetes Pod
- D. A virtual machine
Answer: B
Question 2
Section titled “Question 2”What creates a new layer in a container image?
- A. Every Kubernetes Pod
- B. Every Dockerfile instruction
- C. Every Namespace
- D. Every Deployment
Answer: B
Question 3
Section titled “Question 3”Which identifier is immutable and uniquely identifies a container image?
- A. Image Tag
- B. Container Name
- C. Image Digest
- D. Pod UID
Answer: C
Question 4
Section titled “Question 4”Which AWS service is the recommended private container registry for Amazon EKS?
- A. Amazon S3
- B. Amazon ECR
- C. Amazon EC2
- D. Amazon ECS
Answer: B
Question 5
Section titled “Question 5”Which combination represents enterprise best practice?
- A. Build large images from untrusted public sources and reference them by tag.
- B. Use approved minimal base images, remove unnecessary packages, run as non-root, scan and sign images, and store them in Amazon ECR.
- C. Install all available packages during image creation.
- D. Modify running containers instead of rebuilding images.
Answer: B
What’s Next?
Section titled “What’s Next?”In the next lesson, you will learn about Dockerfile Security Best Practices, where you’ll explore how secure Dockerfile design reduces vulnerabilities, minimizes image size, prevents privilege escalation and builds production-ready container images for Amazon EKS.
➡️ Next Lesson: Lesson 03 — Dockerfile Security Best Practices