A Docker image is a packaged container artifact that includes an application and the files, libraries, and settings needed to run it consistently across systems. Think of it as a read-only template: when started, it becomes a running container. Images are usually built from a Dockerfile and can be versioned, shared, and deployed in development, testing, and production.
In cyber security, Docker images matter because they often define the first trusted state of a service. If an image ships with weak defaults, embedded secrets, outdated packages, or unsafe startup logic, every container launched from it can inherit the same weakness. Attackers look for exposed credentials, misconfigured environment variables, and predictable initialization steps. Defenders reduce risk by rebuilding images from trusted sources, scanning them for vulnerabilities, avoiding hard-coded secrets, and setting unique runtime secrets for each deployment.