The image is a snapshot with a name, and the pull is a copy

Someone spent an afternoon getting the toolchain right: Node 22, Playwright with its browsers, the internal CA, the corporate npm registry. In Docker you'd commit that container and push the image somewhere.

Here you name the moment. POST /api/v1/containers/{id}/snapshots with alias: "toolchain-2026-09". Anyone who wants that machine calls POST /api/v1/containers/{id}/copy with their target_project_id, a target_server_id if they sit on another box, and source_snapshot: "toolchain-2026-09". The copy starts on its own when it lands. copy_firewall_rules: true brings the egress policy along; the SSH key doesn't come, by design, because keys route connections and must be unique.

No registry, no Dockerfile drifting from the container it describes, no layer cache to explain. The image is a snapshot with a name, and the pull is a copy.