Q: A developer submits a Dockerfile that copies a 5GB file, runs a command to compress it to 100MB, and then runs `rm` to delete the original 5GB file in the next step. Why does the final Docker image still weigh over 5GB?
Dockerfile instructions like COPY, RUN, and ADD create immutable, read-only layers.
#Docker #Docker #L1 #Containers #Linux
🎙️ Candidate Opening & Architectural Context
""In an interview, I explain how we diagnosed container runtime failures without guessing. The interviewer is testing: Intersecting image layers natively, Copy-on-Write storage.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Production Solution & Architecture
Dockerfile instructions like COPY, RUN, and ADD create immutable, read-only layers. When the developer copied the 5GB file in Layer 1, it was permanently baked into the image history. When they deleted it in Layer 3 using a subsequent RUN rm command, Docker merely created a new layer with a "whiteout" marker hiding the file. The original 5GB file still exists underneath and is physically downloaded by anyone pulling the image. *Fix:* Operations that download, process, and delete temporary files must be chained together within a single RUN instruction using &&: RUN wget massive.tar && compress massive.tar && rm massive.tar
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Dockerfile instructions like COPY, RUN, and ADD create immutable, read-only layers.."
⚡ 60-Second Elevator Pitch Talking Points
- Immediate Triage: Dockerfile instructions like COPY, RUN, and ADD create immutable, read-only layers.
- Run targeted verification commands before modifying configuration.
- Automate permanent guardrails (CI check, alerts, IaC policy) to prevent recurrence.
Advertisement