Two virtualization models
| Virtual Machine | Container | |
|---|---|---|
| Isolation unit | Guest OS + virtual hardware | Process(es) + kernel namespaces |
| Kernel | One per VM (own kernel) | Shared host kernel |
| Boot time | Seconds (full OS boot) | Milliseconds (process start) |
| Density | Heavier (GB RAM overhead) | Lighter (MB overhead) |
| Security boundary | Hardware-assisted (VT-x, nested paging) | Kernel syscall surface — weaker |
| Use case | Multi-tenant, diff OS, strong isolation | Microservices, CI, same-kernel fleets |
How VMs work (skim)
A hypervisor (KVM, Xen, ESXi) traps privileged guest instructions (VM exits), emulates devices, and maps guest physical → host physical memory. Each VM believes it owns the machine. Type-1 runs on bare metal; Type-2 runs atop a host OS.
How containers work (skim)
A container is ordinary host processes with constrained views: separate PID tree, mount root, network stack, hostname, and resource limits. Docker packages image layers + config; containerd runs the process. No guest kernel — a container syscall is a host kernel syscall with namespace checks.
Image layers vs VM disks
Container images stack read-only layers + a thin writable layer (overlayfs). Duplicate base images share disk and page cache. VM disks are typically monolithic virtual block devices — less sharing, more isolation.
Senior-level signal
"Containers are just lightweight VMs" is wrong and dangerous for security reviews. A kernel CVE escapes all containers on the host; VMs with current hypervisor mitigations contain it to one guest. Run untrusted code in VMs or gVisor/Kata if the threat model requires it — not in plain Docker.
Where this goes next
Linux Namespaces & cgroups details the actual kernel primitives — PID, mount, network namespaces and the cgroup files Kubernetes writes for your pod limits.
Further Reading
Hands-On Tasks (Optional)
Low-setup exercises on your local machine. No autograding — the goal is to build intuition, not pass a test.
- Compare host and container process tables15m
Run `docker run -d nginx`, then `docker top <container>` vs `ps aux | grep nginx` on the host. Note: container processes are host processes with extra isolation — same kernel, different view.