An image is a filesystem diff, not a zip.

Containers are taught as a recipe — copy this Dockerfile, change the base image — and the recipe works, which is the problem. This is a layer store and a builder in your browser, with real digests, a cache that invalidates the way the real one does, and a runtime where your process is PID 1 and has to answer for it.

A working Dockerfile. The build succeeds.

FROM node:24
COPY . .
RUN npm ci && npm run build
CMD ["sh", "-c", "node dist/server.js"]
 
every commit rebuilds npm ci — COPY . . invalidated it
.env is gone from the image and still in layer 2
1.1 GB modelled, 94% of it the base and the toolchain
PID 1 is sh — SIGTERM reaches it and stops there

None of those four is a syntax error and none of them is visible without a model of the layer graph and the runtime contract. So there is one here. The cache rule it teaches is recorded against a real builder before it is taught, and where the corpus and the lesson disagree, the corpus wins.

Start with what an image is Predict a rebuild

Seven tracks

What an image is
What is actually inside the thing you just pushed?
The cache
Which of these instructions is about to run again?
Size
Where did the one-point-four gigabytes come from?
PID 1 and signals
What does your container do when it is asked to stop?
Isolation
What is a container hiding, and what is it sharing?
Limits
Was that a crash or was it the OOM killer?
Reading a generated Dockerfile
What will this build, and what will it ship?