Isolated From What, Exactly: Containers, Images, and Their Boundaries
Deleting a file in a later image layer does not remove it. The removal is recorded as an entry; the bytes are still in the layer below.
-
-
OCI (Open Container Initiative)
Two specifications, one for the package and one for running it. That separation is why your builder and your runtime can come from different vendors.
-
Container Image
A layer is a changeset, not a snapshot. Removals are recorded as entries, which is why a deleted credential still ships.