31/32 · 6 min
Many systems on one machine
One application per physical server wastes most of the hardware. Two technologies share it, and they isolate at different levels.
Virtual machines
A hypervisor presents virtual hardware, and each guest runs a complete operating system with its own kernel.
[ app ][ app ]
[guest OS][guest OS]
[ hypervisor ]
[ hardware ]Type 1 runs directly on the hardware (ESXi, Xen, Hyper-V). Type 2 runs as a program on a host OS (VirtualBox, VMware Workstation), which is more convenient and slower.
Isolation is strong, because a guest genuinely cannot see outside its virtual hardware. The cost is a full OS per guest: gigabytes of disk, hundreds of megabytes of memory, and tens of seconds to boot.
Containers
A container is a process on the host kernel, restricted so it cannot see the rest of the system.
[ app ][ app ][ app ]
[ host kernel ]
[ hardware ]Two kernel features do the work:
Namespaces control what a process can see. Separate namespaces for process ids, network interfaces, mounts, hostnames and users mean a container sees itself as PID 1 with its own network stack.
Control groups limit what it can use: CPU shares, memory ceiling, I/O bandwidth. Exceeding the memory limit gets the process killed, which is what an exit code 137 means.
| Virtual machine | Container | |
|---|---|---|
| Isolation | strong, separate kernel | weaker, shared kernel |
| Start time | tens of seconds | milliseconds |
| Overhead | an entire OS | almost none |
| Guest OS | any | must match the host kernel |
| Density per host | tens | hundreds |
The honest trade
Containers share a kernel. A kernel vulnerability can therefore cross between containers in a way it cannot cross between virtual machines. For workloads from a single trusted source that is usually acceptable; for running untrusted code from strangers it is not, which is why cloud providers still run VMs underneath and often containers inside those.
Why it changed deployment
The value is less about density than about the image. A container image contains the application and every library it needs, so "works on my machine" stops being a category of problem: the machine comes with it.
That is also the answer to a common confusion. A container is not a lightweight virtual machine. It is a normal process, with a restricted view and a bundled filesystem.