Understanding docker images (boot2docker)

I’m trying to understand how docker works under Windows in contrary to, say, Linux. Under Linux the docker image runs natively under the linux host, right?

Und Windows 7 (e.g.) a virtual machine (Virtual Box) is required to run the docker image in boot2docker, right? So boot2docker is the host that runs the docker image.

There are ways to log into that image (ssh), enter commands in the run window of Virtual Box (the default machine, if I’m right).

Given I run a docker image from the docker hub by saying

docker run -d vendor/product:version

then this image may contain some vendor software, apache and tomcat.
My aim will now be to “augment” this image by some other software. Deinstall e.g. apache and install haproxy.

But tools like apt-get which I’m used to e.g. in Ubuntu are missing from that image.

I can run Ubuntu now, but what happens with my previously run vendor/product
docker image? Does it coexist. Is it overlaid with the ubuntu image`? Is it merged?

Last question: How to I save modifications/augmentations/configuration to the image(s) and make them permanently available?

What is the difference between docker run and docker pull