The virtual filesystem is how Docker can take a set of physical image layers and treat them as one logical container image. Image layers are mounted as read-only parts of the filesystem in a container, so they can't be altered, and that's how they can be safely shared by many containers.
Each container has its own writeable layer on top of all of the read-only layers, so every container can modify its own data without affecting any other containers:
This diagram shows two containers running from the same image. The image (1) is physically composed of many layers: one built from each instruction in the ...
