Isolated From What, Exactly: Containers, Images, and Their Boundaries
Deleting a file in a later image layer does not remove it. The removal is recorded as an entry; the bytes are still in the layer below.
-
-
OCI (Open Container Initiative)
Two specifications, one for the package and one for running it. That separation is why your builder and your runtime can come from different vendors.
-
Container Image
A layer is a changeset, not a snapshot. Removals are recorded as entries, which is why a deleted credential still ships.
-
You Rented the Server, Not the Outcome: Cloud Execution Models and Who Is Responsible
Moving to a managed service transfers the patching and keeps the consequences. Knowing which line moved is the difference between a plan and a surprise.