Docker Images on Filesystem

Question

I try to understand how docker stores images and layers on the filesystem. When building an image, the layers appear in /var/lib/docker/image/overlay2/layerdb and the image in /var/lib/docker/image/overlay2/imagedb. But there are also files in /var/lib/docker/overlay2/. I'm wondering now what's the difference between them.

tree /var/lib/docker/
|-- builder
|-- buildkit
|-- containerd
|-- containers
|-- image
|   `-- overlay2
|       |-- distribution
|       |-- imagedb
|       |   |-- content
|       |   |   `-- sha256
|       |   `-- metadata
|       |       `-- sha256
|       |-- layerdb
|       `-- repositories.json
|-- network
|-- overlay2
|   `-- l
|-- plugins
|-- runtimes
|-- swarm
|-- tmp
|-- trust

Answer 1

Ok so I might be wrong since I'm not a Docker expert. But this is what I've figured out so far after some time digging into this topic.

When you pull an image, for example docker pull node:6

Then inspect the image docker inspect node:6, you will see something like this:

[
  {
    "Id": "sha256:09028f4b5ca3d043b5b3698b62defdbee3ecd8185608897c25e63a2af7e6e19c",
    ....
    "RootFS": {
        "Type": "layers",
        "Layers": [
            "sha256:dd1eb1fd7e08dc9bda0cbea31a89196c453cb218bea80ce64eeb19fadc98d262",
            "sha256:a42d312a03bb549752cfaf828dca867cb03763699732a584bb4fa119e0130760",
            "sha256:858cd8541f7e8b7b5bb9c72e1757f7c3c8d270b7e21dae30579e0df635ddeacf",
            "sha256:8451f9fe00162c8ff891c8982c5bf107cccbe1982718ef80565229ee69dd54cf",
            "sha256:cbda574aa37a39a4cdf2898aa974efaf2b6035e8a25992eb1914394b209a54fb",
            "sha256:e492023cc4f9bce9e608a6a6f2bb9f223167bab8a3d8d01581125a5dedc18524",
            "sha256:b40c77c13a01fc9208237a4a2ee330ad56b7978a81d7c3b545613d06f9d3a6bb",
            "sha256:35adca6bf7fec06b18c63a4d4fcf09e0427f61ce0788a09166a869273f894861"
        ]
    },
  }
]

/var/lib/docker/image/overlay2/imagedb/content/sha256 stores the content of the image. You will be able to find 09028f4b5ca3d043b5b3698b62defdbee3ecd8185608897c25e63a2af7e6e19c here

/var/lib/docker/image/overlay2/layerdb/sha256 stores some chain that links to the actual layer. For example, if you try to find the first layer in the above inspect (dd1eb1f...) then look at the cache-id file, you will see the actual layer id. In this case I see 4cc446db3a09d2b9146604a6e0a8da9bc37cec32a6b9e7dfa02e21235f1f2e95

Now go to /var/lib/docker/overlay2 and search for it (4cc44...), you will find it. I think this directory actually stores all the layers.