Where are Docker Images Stored? Docker Container Paths Explained

Sebastian Barthel

Docker has been widely adopted and is used to run and scale applications in production. Additionally, it can be used to start applications quickly by executing a single Docker command.

Companies also are investing more and more effort into improving development in local and remote Docker containers, which comes with a lot of advantages as well.

You can get the basic information about your Docker configuration by executing:

The output contains information about your storage driver and your docker root directory.

The storage location of Docker images and containers

A Docker container consists of network settings, volumes, and images. The location of Docker files depends on your operating system. Here is an overview for the most used operating systems:

• Ubuntu: /var/lib/docker/
• Fedora: /var/lib/docker/
• Debian: /var/lib/docker/
• Windows: C:\ProgramData\DockerDesktop
• MacOS:

In macOS and Windows, Docker runs Linux containers in a virtual environment. Therefore, there are some additional things to know.

Docker for Mac

Docker is not natively compatible with macOS, so Hyperkit is used to run a virtual image. Its virtual image data is located in:

Within the virtual image, the path is the default Docker path /var/lib/docker .

You can investigate your Docker root directory by creating a shell in the virtual environment:

You can kill this session by pressing Ctrl+a, followed by pressing k and y.

Docker for Windows

On Windows, Docker is a bit fractioned. There are native Windows containers that work similarly to Linux containers. Linux containers are run in a minimal Hyper-V based virtual environment.

The configuration and the virtual image to execute linux images are saved in the default Docker root folder.

If you inspect regular images then you will get linux paths like:

You can connect to the virtual image by:

There, you can go to the referenced location:

The internal structure of the Docker root folder

Inside /var/lib/docker , different information is stored. For example, data for containers, volumes, builds, networks, and clusters.

Docker images

The heaviest contents are usually images. If you use the default storage driver overlay2, then your Docker images are stored in /var/lib/docker/overlay2 . There, you can find different files that represent read-only layers of a Docker image and a layer on top of it that contains your changes.

Let’s explore the content by using an example:

The LowerDir contains the read-only layers of an image. The read-write layer that represents changes are part of the UpperDir. In my case, the NGINX UpperDir folder contains the log files:

The MergedDir represents the result of the UpperDir and LowerDir that is used by Docker to run the container. The WorkDir is an internal directory for overlay2 and should be empty.

Docker Volumes

It is possible to add a persistent store to containers to keep data longer than the container exists or to share the volume with the host or with other containers. A container can be started with a volume by using the -v option:

We can get information about the connected volume location by:

The referenced directory contains files from the location /var/log of the NGINX container.

Clean up space used by Docker

It is recommended to use the Docker command to clean up unused containers. Container, networks, images, and the build cache can be cleaned up by executing:

Additionally, you can also remove unused volumes by executing:

Summary

Docker is an important part of many people’s environments and tooling. Sometimes, Docker feels a bit like magic by solving issues in a very smart way without telling the user how things are done behind the scenes. Still, Docker is a regular tool that stores its heavy parts in locations that can be opened and changed.

Sometimes, storage can fill up quickly. Therefore, it’s useful to inspect its root folder, but it is not recommended to delete or change any files manually. Instead, the prune commands can be used to free up disk space.

I hope you enjoyed the article. If you like it and feel the need for a round of applause, follow me on Twitter. I work at eBay Kleinanzeigen, one of the biggest classified companies globally. By the way, we are hiring!

Happy Docker exploring 🙂

References

• Docker storagediver documentation
  https://docs.docker.com/storage/storagedriver/
• Documentation Overlay filesystem
  https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt

Sebastian Barthel

Software engineer who loves writing software and teaching people in software engineering and machine learning. Since 2019, I work for one of eBay‘s classified business called eBay Kleinanzeigen.

If you read this far, tweet to the author to show them you care. Tweet a thanks

Learn to code for free. freeCodeCamp’s open source curriculum has helped more than 40,000 people get jobs as developers. Get started

freeCodeCamp is a donor-supported tax-exempt 501(c)(3) nonprofit organization (United States Federal Tax Identification Number: 82-0779546)

Our mission: to help people learn to code for free. We accomplish this by creating thousands of videos, articles, and interactive coding lessons — all freely available to the public. We also have thousands of freeCodeCamp study groups around the world.

Donations to freeCodeCamp go toward our education initiatives, and help pay for servers, services, and staff.

Where are docker images and containers stored when we use it with Windows?

NOTE: Am super new to both Windows and Docker

The tutorial I’ve been using says that they are under /var/lib/docker/containers if we’re using Linux, but I can’t seem to find that on my Windows machine.

5 Answers 5

Enter docker-machine with

there you should find your containers.

Things might have changed with Windows 10 Anniversary Update. I installed Docker from source here (https://master.dockerproject.org/windows/amd64/docker-1.13.0-dev.zip) as described here:

Docker puts all of the images in this folder:

and all containers in this folder:

An easy way to check is to execute this:

It should tell you where your files are stored:

After review some post on Stackoverflow and Google. I found this directory :

Here you can fin the configuration with the Virtual Machines

Another important thing is the images are virtualized by the Hyper-V, so the info should be stored here.

Update 2020 for WSL2

If you’re using this with WSL2, docker images will be maintained inside of your wsl drive available at \\wsl$\ per this github issue:

• Windows: \\wsl$\docker-desktop-data\mnt\wsl\docker-desktop-data\data\docker\volumes
• Linux: sudo ls /mnt/wsl/docker-desktop-data/data/docker/volumes

Docker installed on windows with docker toolbox(using virtual box in place of hyper-v) one VM is created on at C:\Users\YOURUSERNAME\.docker\machine\machines with name default so you can find all VM files in default folder.

you can connect this vm using

and you can find pulled images and container under this path (you may need to use sudo sometimes)

Where is docker image location in Windows 10?

I’ using Windows 10 Home operating system. I have installed Docker toolbox.

I have created docker image of my .net core application by using following command.

Now I want to ship this image, to other machine. But I am not getting image file.

Can someone please tell me, where my image will get saved? Or is there any way, to specify docker image path in docker build command.

15 Answers 15

On Windows 10, right click on the docker icon in the system tray (right hand side of task bar) and choose Settings. In the Advanced pane, you’ll see something like:

1. By using the docker info command.
2. In the result — check for Docker Root Dir

This folder will conatins images, containers, .

The answers are really confusing because there is more than one way to run Docker in Windows. The newest way is with Windows 10 Home May 2020 Update. I will use the new version of Windows Subsystem for Linux (WSL2).

After activating WSL2, you’ll install Docker Desktop. Docker Desktop is a client that’ll connect to the host inside the WSL.

The image directory is somewhat inconsistent. If you run docker info in your host machine or inside WSL it will give you the path Docker Root Dir: /var/lib/docker which doesn’t exist:

You’ll find the images in

Or in this Windows Explorer path:

If you are using Windows 10 non-Home versions, it may work differently. Take a look at the other answers. Since I don’t have access to this OS, I won’t try to answer.

All the answers have been outdated or incorrect for me, I found it in %AppData%\Local\Docker\wsl

When you have Windows Containers activated, your images are stored by default in C:\ProgramData\Docker\

To change this, you can edit the C:\ProgramData\Docker\config\daemon.json and add a new «graph» key with the new path. (notice that every backslash is escaped with another backslash)

After that, you need to restart Docker service and you can verify your changes using docker info command and look at Docker Root Dir entry.

If you are on windows 10 and running windows containers

In the above image, docker is running windows containers. So its showing switch to linux containers.

First run docker info command (more specific docker info —format “<>” ).

You should see root dir as

Docker Root Dir: C:\ProgramData\Docker

Now run a command to pull an image like

After it pulls the image, you can look into the docker root dir.

Notice the current modified date time. In one of the folders you can see the sha of the layers.

Finally, you also have to take a look into the following folder, if you want to know where the images are downloaded. The two folders above and below are

Now for linux images.

If your docker is running windows containers, and then if you try to fetch a linux based container such as nginx, like so

you will get a message as follows.

So switch to linux contaners. See the very first image.

Once the docker for linux is running, run the command again.

You can see that image is downloading.

Now where is this image downloaded on your hard disk? docker info command may not help much in this case.

So start again. Click Settings and not «Switch to Windows Containers. «

And now see the path.

On my machine, it’s C:\ProgramData\DockerDesktop\vm-data

Note the date modified column. Notice and observe that after you pull or remove a linux based image.

That’s a diskspace reserved for linux env, so you will not be able to browse further down to see where the image is.

but if you have to, then launch a linux based VM, install docker and explore the path /var/lib/docker/

Sometimes you may encounter permission issues. If so see this and this

Where are Docker images stored?

12 December 2013

If you’re just starting out with Docker, it’s super easy to follow the examples, get started and run a few things. However, moving to the next step, making your own Dockerfiles, can be a bit confusing. One of the more common points of confusion seems to be:

Where are my Docker images stored?

— Everyone

I know this certainly left me scratching my head a bit. Even worse, as a n00b, the last thing you want to do is publish your tinkering on the public Docker Index.

Checkout my awesome new Docker image thoward/i_have_no_idea_what_im_doing .

Yeah. Not really what I want to do.

Even worse, for quite a while there was no way to delete something that you had published, so your shamefully awkward learning process was up there for good. Luckily, deleting published Docker repositories is now quite easy.

So let me start with this small assurance; Nothing you do will become public especially if:

1. You haven’t made an account on the public index.
2. You haven’t run docker login to authenticate via the command-line client.
3. You don’t run docker push , to push an image up to the index.

Vocabulary

One of the things that contributes to much of the confusion around Docker is the language that’s used. There’s a lot of terminology which seem to overlap, or is a bit ambiguous, used somewhat incorrectly, or has a well-established meaning that is different from how Docker uses it.

I’ll try to clear those up here, in a quick vocabulary lesson.

Image vs Dockerfile

This one is the least confusing, but it’s an important distinction. Docker uses images to run your code, not the Dockerfile. The Dockerfile is used to build the image when you run docker build .

If you go browsing around on the Docker Index, you’ll see lots of images listed there, but weirdly, you can’t see the Dockerfile that built them. The image is an opaque asset that is compiled from the Dockerfile.

When you run docker push to publish an image, it’s not publishing your source code, it’s publishing the image that was built from your source code.

Registry vs Index

The next weird thing is the idea of a Registry and an _Index_, and how these are separate things.

An index manages user accounts, permissions, search, tagging, and all that nice stuff that’s in the public web interface.

A registry stores and serves up the actual image assets, and it delegates authentication to the index.

When you run docker search , it’s searching the index_, not the _registry. In fact, it might be searching multiple registries that the index is aware of.

When you run docker push or docker pull , the index determines if you are allowed to access or modify the image, but the registry is the piece that stores it or sends it down the wire to you after the index approves the operation. Also, the index figures out which registry that particular image lives in and forwards the request appropriately.

Beyond that, when you’re working locally and running commands like docker images , you’re interacting with something that is neither an index or a registry, but a little of both.

Repository

Docker’s use of this word is similar to its use at Github, and other source control systems, but also, kind of not.

Three common head-scratching questions are:

• What’s the difference between a repository and a registry?
• What’s the difference between a repository and an image?
• What’s the difference between a repository and an index username?

In fact, this is a problem, because a repository is all of those things and not really any of them either. Further, when you run docker images you get output like this:

So, the list of images seems to be a list of repositories? Huh? Actually the images are the GUIDs, but that’s not how you interact with them.

Let’s start over with this.

When you run docker build or docker commit , you can specify a name for the image. The name is usually in the format of username/image_name , but it doesn’t have to be. It could be anything, and it could even be the same as something well known and published.

However, when the time comes to docker push , the index will look at the name, and will check to see if it has a matching repository. If it does, it will check to see if you have access to that repository_, and if so, allow you to push the new version of the _image to it. So, a registry holds a collection of named repositories_, which themselves are a _collection of images tracked by GUIDs. This is also where tags come in. You can tag an image, and store multiple versions of that image with different GUIDs in a single named _repository_, access different tagged versions of an image with a special syntax like username/image_name:tag .

If we look at the output from docker images again, now it makes a little more sense. We have five different versions of the image named ubuntu , each one tagged slightly differently. The repository holds all of those under that name ubuntu . So, while it may seem like ubuntu is an image name, it’s actually a repository name, indicating where it came from, or where it should go during a push.

Further, the repository name has a specific schema to it. An index can parse out the username from first part, and figure out where it is.

So, this the confusing part: Suppose there’s a Docker image called thoward/scooby_snacks .

The official «repository name» is thoward/scooby_snacks , even though we would normally think of the repository as just being scooby_snacks (eg, in GitHub, or elsewhere).

In fact, when the Docker documentation refers to a _repository_, it sometimes means the whole thing, username included, and sometimes only means the part after the username.

That’s because some repositories don’t have usernames (like ubuntu ). The username is very important to handle separately, because it’s used for authentication by the _index_, so that part of the repository name has its own semantics separate from the name, when it’s there.

Local Storage on the Docker Host

So far I’ve been explaining the intricacies of remote storage, and how that relates to the confusing vocabulary, but running docker images shows you only what is local to your machine.

Where is this stuff? The first place to look is in /var/lib/docker/ .

Open up the file repositories to find a JSON list of the repositories on your host:

Hey, that matches the output from docker images !

Checkout what’s in /var/lib/docker/graph/ :

Not terribly friendly, but we can see how Docker is keeping track of these, based on the repositories JSON file which holds a mapping of repository names and tags, to the underlying image GUIDs.

We have two images from the ubuntu repository, with the tags 12.04, precise, and latest all corresponding to the image with id 8dbd9e392a964056420e5d58ca5cc376ef18e2de93b5cc90e868a1bbc8318c1c (or 8dbd9e392a96 for short).

So what’s actually stored there?

The entries here are:

• json — holds metadata about the image
• layersize — just a number, indicating the size of the layer
• layer/ — sub-directory that holds the rootfs for the container image

Pretty easy. This is the magic behind being able to refer to an image by its repository name, even if you’re not interacting with the remote Docker Index or Docker Registry. Once you’ve pulled it down to your workstation, Docker can work with it by name using these files. This is also where things go when you’re developing a new Dockerfile.

DIY Dockerfiles

Let’s try an example. Make a Dockerfile with the following contents:

This basically doesn’t do anything except say that we’re including the ubuntu image as our base layer, but that’s enough to get started.

Next, run docker build -t scooby_snacks . . What that will do is look in the directory we specified ( . ) for a file called Dockerfile and then build it, and use the name scooby_snacks for the repository.

Oh no! It said «Uploading context»… Did we just upload it to the public registry?

Whew! Not there. So why did it say that?

I have no idea, but you can ignore it. Where did it really end up?

Well, looks like Docker just «uploaded» it to /var/lib/docker . 🙂

It should also show up in docker images .

There it is! Docker was smart enough to realize that we didn’t change anything, so it kept the same image id, and didn’t bother copying the ubuntu image. Pretty sweet.

Next, we’ll make a small change so that Docker will have to build a new layer.

Edit Dockerfile to have these contents:

Then run docker build -t scooby_snacks . to rebuild.

There should be a new directory under /var/lib/docker/graph

Docker gave it a new image ID :

It has also been updated in /var/lib/docker/repositories and docker images .

Let’s see what /var/lib/docker/graph/91acef3a5936769f763729529e736681e5079dc6ddf6ab0e61c327a93d163df9 looks like now:

Our tiny change had a big impact! Notice that Docker only kept the differences from the base image. This is the key to the layer concept.

Run it!

We can now run our new image and try it out. We’ll just run an interactive bash prompt for now.

The effects of our RUN touch scooby_snacks.txt command in the Dockerfile are exactly as expected.

Publish it!

Until now, we’ve been doing everything locally and not interacting with the outside world at all. This is great, we can work up a perfect Dockerfile before we go live. That said, I’m pretty happy with this one now, and I’m ready to publish it.

If you haven’t already, make sure you make an account, and then login with docker login .

Publish the image with docker push scooby_snacks

Oops. Docker Index won’t let us publish without our username in the repository name. No big deal.

Rebuild this with the correct username using docker build -t thoward/scooby_snacks .

Nice! The message «Using cache» means Docker was smart enough to know that we didn’t really change the image, so it didn’t bother rebuilding it.

Let’s try publishing again, but this time with the correct repository name:

Now that it’s published, it should show up with docker search .

There it is. Next, let’s cleanup a bit and delete the old root level one:

Ok, that one is gone.

Also, to be honest, this is not a very interesting image to share publicly, and we don’t want to look like n00bs, so let’s delete it as well.

This time, since Docker realized it was the last reference to that image ID , docker rmi has an additional message indicating that it deleted it instead of just ‘untagging’ it.

But wait! It is still public at the Docker Index, isn’t it? Let’s check:

Hmm.. Well this is handy, before we delete it, we can try docker pull and fetch it down like a «real» image and run it.

Deleting a Published Repository

Unfortunately, to delete it from the public index/registry, we have to use the web interface, not the command-line.

Click on ‘Settings’ tab, then ‘Delete Repository’ tab, then the ‘Delete Repo’ button.

Back on the command-line we can verify it’s gone with docker search scooby_snacks

But of course, since we never deleted the local version of it after we pulled it back down, it’s still going to show up in docker images , since we have a local copy:

So to completely remove it we need to run docker rmi again.

Not to worry, we can always rebuild it with our Dockerfile . 🙂

Important Security Lesson

It’s really important to consider the security implications of what we just saw though.

Even if a Docker image is deleted from the Docker Index it may still be out there on someones machine. There’s no way to change that.

Also, as we saw when looking at the files we have locally, it’s not quite an «opaque binary» image. All the information from the Dockerfile was in the JSON file for the image, and the artifacts of those commands are in the layer, as accessible as a filesystem. If you accidentally published a password or key, or some other critical secret, there’s no getting it back, and people can find as easily as they can find anything else in a published open source code base.

Be very careful about what you’re publishing. If you do accidentally publish a secret, take it down right away and update credentials on whatever systems it might have compromised.

Conclusion

Docker can be a bit confusing with its terminology, but once you wrap your head around the basic workflow described here, it should be very easy to be in-control of what you’re building, knowing exactly when and how you share that with the world.

Opinions? Discuss this article on Twitter .

Hi, I’m Troy Howard and this is my blog.

Want to chat? Come find me on Twitter, or GitHub.

© 2019 Troy Howard — powered by Wintersmith