Chapter 6 · Containers·v1.0.0·Updated 7/7/2026·~11 min
What's changed: Initial version (topic 2.06, subtopics 2.06.1–2.06.2)
6.1How Containers Work
Key points
Learn how containers differ from physical machines and VMs, and the two kernel features behind their lightness: namespaces and cgroups. Also covers the relationship between the container filesystem and its image (read-only layers plus a writable layer).
Chapter 2.05 covered virtual machines. A container is an even lighter form of virtualization: multiple applications share one host kernel while each appears to run as its own isolated set of processes. No special hardware is involved—just isolation and limiting features built into the Linux kernel.
6.1.1Physical machines, VMs, and containers
- Physical machine = one OS on one piece of hardware. Resources are fully dedicated, but cost scales with the number of machines.
- Virtual machine = a hypervisor virtualizes hardware, and each guest runs its own kernel. Isolation is strong, but each guest OS adds overhead (boot time, memory, disk).
- Container = shares the host kernel and isolates at the process level. With no guest OS, startup takes well under a second and memory use is low, so a single host can run many containers. The trade-off: it cannot run a guest needing a different kernel (e.g., a different OS family).
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.