Containers vs VMs

Containers vs VMs

Step 1 of 10

 

 

Two ways to isolate an app on one machine: a virtual machine, or a container.

The Idea

A virtual machine runs a whole guest operating system, with its own kernel, on a hypervisor. A container is an isolated process that shares the host's kernel. Linux namespaces limit what it can see — its own processes, network and mounts — and control groups (cgroups) limit what it can use: CPU and memory.

Real-World Example

A team runs a dozen small services on one host as containers. Each has its own filesystem and network, and each gets a --memory and --cpus limit, so a leaking service hits its own ceiling instead of starving its neighbours. Sharing one kernel is why more of them fit on the same machine.

The Tradeoff

Every container on the host depends on that one kernel, so the boundary is thinner than a VM's separate kernel. And limits are opt-in: by default a container can use as much CPU and memory as the host's kernel scheduler allows.

Hands-On

# illustrative — one container, with its own limits
docker run -d --name api --memory 256m --cpus 0.5 -p 8080:80 nginx
docker stats api    # live CPU and memory, against the limit

Your turn

Put the steps in the right order.

1. 1The daemon sets up namespaces and a cgroup for the new process↑↓
2. 2docker run asks the Docker daemon for a container↑↓
3. 3The process runs on the shared host kernel, inside its limits↑↓
4. 4The daemon pulls the image if it is not already local↑↓

Check order

Mini quiz

1 / 3

What do containers on one host share that virtual machines do not?

• AThe host's kernel
• BA hypervisor per container
• COne filesystem
• DOne network namespace

Sources

• What is a container? — Docker Docs
• What is Docker? — Docker Docs
• Resource constraints — Docker Docs
• About cgroup v2 — Kubernetes Documentation