Docker: what is the difference between an image and a container?

Image = read-only template (built from a Dockerfile, layered filesystem, no running processes). Container = a running instance of an image (writable layer on top + its own PID/network namespace). One image, many containers. Class vs object is the closest analogy.