CodeParkA virtual machine (VM) runs a full guest operating system with its own kernel. It sits on top of a hypervisor, the software that splits one physical machine into many virtual ones. A container is just a process on the host. It shares the host's kernel, so there is no guest OS to boot.
Isolation comes from two Linux kernel features:
- Namespaces give the process its own view of PIDs, network, mounts, hostname and users.
- cgroups (control groups) limit how much CPU, memory and I/O the process can use.
The filesystem comes from image layers. A union filesystem such as overlay2 stacks these layers into one view.
The result: containers start in milliseconds. They use far less memory and disk than VMs. The trade-off is weaker isolation. A kernel vulnerability can affect every container on the host. Also, a Linux container needs a Linux kernel. On macOS and Windows, Docker Desktop runs one inside a lightweight VM.
- A VM has its own guest OS and kernel, and runs on a hypervisor.
- A container is a host process that shares the host kernel.
- Namespaces isolate the process, and cgroups limit its resources.
- Containers are lighter than VMs and start faster.
- Containers have a weaker isolation boundary than a VM.
Read more