It is done solely between the Lightning nodes, and nothing touches the main chain until the channel is closed. To get a little bit more complicated (the jar analogy doesn't really hold up beyond this point):

Let's say you and I open a channel with 1 BTC each, for a total of 2 BTC. We both (or rather, our software does this automatically) sign a transaction which sends 1 BTC to you and 1 BTC to me. This would be our closing transaction, if we broadcast it. But we don't, we just save it locally, so no one knows about it except us. Then I pay you 0.2 BTC, so now we both sign a transaction which sends 1.2 BTC to you and 0.8 BTC to me. Again, we save this locally but do not broadcast it. Every time we make a new payment between us, we both sign a new transaction to reflect the new distribution of coins. When we want to close the channel, we simply broadcast the most recent transaction we have saved.

And so it is each participant in a channel who is responsible for the intermediate transactions, while the wider network only ever knows about the opening and the closing transactions.

There are additional complex systems built on top of that in order to encourage honesty and punish any attempted theft. For example, if the latest transaction we had signed was 1.6 BTC to me and 0.24 BTC to you, but you tried to broadcast an old transaction which splits the funds 1 BTC each, there is a mechanism to allow me to dispute that and claim all the funds for myself, meaning you lose everything as punishment for the attempted theft.