Document images.

docs/container-environment.md

@@ -7,7 +7,7 @@ This document describes the environment for Kubelet managed containers on a Kube
 This cluster information makes it possible to build applications that are *cluster aware*.  
 Additionally, the Kubernetes container environment defines a series of signals that are surfaced to optional signal handlers defined as part of individual containers.  Container signals are somewhat analagous to operating system signals in a traditional process model.   However these signals are designed to make it easier to build reliable, scalable cloud applications in the Kubernetes cluster.  Containers that participate in this cluster lifecycle become *cluster native*. 
 
-Another important part of the container environment is the file system that is available to the container.  In Kubernetes, the filesystem is a combination of the Docker image and pod volumes. The design and usage of pod volumes is described in its own [document](docs/volumes.md)
+Another important part of the container environment is the file system that is available to the container.  In Kubernetes, the filesystem is a combination of an [image](./images.md) and one or more [volumes](./volumes.md).
 
 
 The following sections describe both the cluster information provided to containers, as well as the signals and life-cycle that allows containers to interact with the management system.

docs/images.md

@@ -0,0 +1,23 @@
+# Images
+Each container in a pod has its own image.  Currently, the only type of image supported is a [Docker Image](https://docs.docker.com/userguide/dockerimages/).
+
+You create your Docker image and push it to a registry before referring to it in a kubernetes pod.
+
+The `image` property of a container supports the same syntax as the `docker` command does, including private registries and tags.
+
+## Using a Private Registry
+Keys for private registries are stored in a `.dockercfg` file.  Create a config file by running `docker login <registry>.<domain>` and then copying the resulting `.dockercfg` file to the kubelet working dir.
+The kubelet working dir varies by cloud provider.  It is `/` on GCE and `/home/core` on CoreOS.  You can determine the working dir by running this command:
+`sudo ls -ld /proc/$(pidof kubelet)/cwd` on a kNode.
+
+All users of the cluster will have access to any private registry in the `.dockercfg`.
+
+## Preloading Images
+
+Be default, the kubelet will try to pull each image from the specified registry.
+However, if the `imagePullPolicy` property of the container is set to `PullIfNotPresent` or `PullNever`,
+then a local image is used (preferentially or exclusively, respectively).
+
+This can be used to preload certain images for speed or as an alternative to authenticating to a private registry.
+
+Pull Policy is per-container, but any user of the cluster will have access to all local images.