The hidden design compromises of Docker layers

In a recent investigation into Docker layer architecture, a reporter delved into the intricacies of how these layers function and discovered some hidden design compromises. Docker layers are built upon tar archives stacked on top of one another, creating a filesystem. However, the reporter found it challenging to explain how one layer can delete a file created by a previous layer, given that tar archives do not have a deletion operation.

This led to a deeper exploration of the OCI Image Specification, which describes image layers as changesets, containing additions, modifications, and removals. The reporter noted that while additions and modifications are straightforward to represent in tar, removals posed a challenge. The OCI specification defines three types of changes: additions, modifications, and removals.

The addition and modification of files are easily represented in tar archives, but removals are trickier. The reporter explained that a tar archive consists of a sequential stream of entries, each with a header containing the file path and metadata, followed by the file contents. Each entry includes a timestamp, indicating when the file was added or modified.

However, representation of deletions in tar archives is not standard. The reporter suggested that a workaround could involve using an "opaque" directory, which is a special directory name that cannot be faithfully included in a container image. This workaround allows for the deletion of files from previous layers. The reporter emphasized that understanding Docker layers and their underlying architecture is crucial for developers using Docker, as the layers are not merely tar archives but filesystem changesets that only hold meaning when applied sequentially.

The reporter concluded by inviting readers to discuss whether the use of "whiteouts" in Docker layers is an elegant extension of tar or a hacky workaround, acknowledging the arguments for both perspectives.