Docker images use a union filesystem with additive layers. Deleting a file in a later layer only adds a "whiteout" marker; the original file remains in its layer and can be extracted using `docker save` and `tar`.