Another way of describing it, rather than a Docker/Container image being a group of layered archives, each with changes, instead a list of file hashes is distri

Another way of describing it, rather than a Docker/Container image being a group of layered archives, each with changes, instead a list of file hashes is distributed, detailing where those files need to be in a mounted filesystem, with x permissions. Since everything is named based on hashes, content is naturally deduplicated if two images share the same files and all files are stored in the same place. If you boot on top of a composed filesystem, you also get easy file verification as long as the booted list is signed and unmodified. If you modify the local files, the hashes won't match.