This is an easy question to answer experimentally. Start a container:
docker run -it ubuntu
Touch something and exit the container:
root@914f5453af3c:/# touch /bin/ls
root@914f5453af3c:/# exit
Save the container as a new image:
$ docker commit 914f5453af3c testimage
Export the image layers to a local directory:
$ mkdir testimage
$ docker save testimage | tar -C testimage -xf-
This will give you a directory that looks something like:
$ ls testimage
15c6fddb70d1d281b7c20cdd5a54be3379c4c282a3e9ba2ae27c79a655ca9ed6
46bda337e95a0163468d9daa3a13ba104507f68186a09cdb2892b20030aeb530
63c22c7d4e3cd1a04ada1a24dd84837c1ce0c445bb48b75ed45f84250146459f
6d1bde67c5695c66882fd71951376e176ba908fc9a560bd8eeb07c4b4797da89
7c05062524dd680596681fb193b3096fcd775da2c0e7e66e0ad580850ee3a973.json
96ab7e8335a8dff5ed0144a46ddbe6ab6c1e76011670cb54efc515c46ea6b09b
fbe2d84b180c3f84eb15754cf95e1a6359a84ed3c6e2f6869f0a2015343611fc
manifest.json
repositories
Look at repositories
to find the topmost layer:
$ cat testimage/repositories
{"testimage":{"latest":"6d1bde67c5695c66882fd71951376e176ba908fc9a560bd8eeb07c4b4797da89"}}
Look at the contents of that layer:
$ tar -tf testimage/6d1bde67c5695c66882fd71951376e176ba908fc9a560bd8eeb07c4b4797da89/
layer.tar
bin/
bin/ls
root/
root/.bash_history
And there you can see that the topmost layer has a copy of /bin/ls
as a result of running touch
.