Containers and virtual machines

Learn the differences between containers and virtual machines.

Containers and virtual machines

A virtual machine (VM) emulates a full computer with its own operating system kernel on top of a hypervisor; it takes minutes to boot and its size is measured in gigabytes. A container instead shares the host machine's kernel; it carries only the application and its libraries. That is why it starts in seconds and is measured in megabytes.

VM:        App | Libraries | Guest operating system | Hypervisor | Hardware
Container: App | Libraries | Docker Engine | Host operating system | Hardware

How strong is the isolation?

Container isolation relies on two Linux kernel features: namespaces (separating the view of processes, network and file system) and cgroups (limiting CPU and memory). Since the kernel is shared, the isolation is weaker than a VM's; for running untrusted code, VMs or extra layers such as gVisor are preferred.

docker run --memory 256m --cpus 0.5 nginx   # limiting with cgroups

Exercise A resource-limited container

Write the command running the nginx image with at most 512m memory and 1 CPU.

Test yourself

Why do containers start faster than virtual machines?
- They share the host kernel; they don't boot a separate operating system
- They are written in languages that use less RAM
- They only run on Linux
- They don't connect to the internet
Show answer

They share the host kernel; they don't boot a separate operating system — A VM boots a guest operating system from scratch; a container just starts a process.

Limit the container's memory to 256 MB.

docker run --____ 256m nginx

Show answer

docker run --memory 256m nginx

Match the properties.

sanal makine

Has its own kernel
container

Shares the kernel
namespace

Isolates the view
cgroup

Limits resources

Next lesson: Images and containers

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies