Containers provide OS-level virtualization — multiple isolated user-space environments sharing the same kernel. Unlike VMs (which virtualize hardware), containers virtualize the OS itself.
Namespaces — What the Container Can See
Each container gets its own view of the system, isolated via Linux namespaces:
| Namespace | What it isolates | Why it matters |
|---|---|---|
| PID | Process IDs | Container processes see only their own process tree |
| Network | Network interfaces, IP, routing | Each container has its own eth0, port space |
| Mount | Mount points, filesystem | Container has its own root filesystem |
| UTS | Hostname, domain name | Container can have its own hostname |
| IPC | Inter-process communication | System V IPC, POSIX message queues |
| User | User and group IDs | Root inside container ≠ root outside |
| Cgroup | Cgroup hierarchy | Resource limits visibility |
When Docker runs a container, it creates new namespaces for that container. The container’s PID 1 is PID 4242 on the host — but inside the PID namespace, it sees itself as PID 1.
CGroups — What the Container Can Use
Cgroups (control groups) limit and account for resource usage:
| Resource | What cgroup controls |
|---|---|
| CPU | Limit CPU share or number of cores |
| Memory | Set hard/soft memory limits |
| Disk I/O | Throttle read/write bandwidth |
| Network | Classify and prioritize traffic |
| PIDs | Limit total processes in the cgroup |
Container vs Image
- Image: read-only template (layered filesystem). Immutable.
- Container: a running instance of an image — read-write layer on top of the image’s read-only layers.
Why Containers Are Lightweight
| VM | Container | |
|---|---|---|
| OS per unit | Full guest OS (GB) | Shared kernel (MB) |
| Boot time | Minutes | Milliseconds |
| Memory overhead | GB (OS + app) | MB (just app) |
| Density per host | Tens | Hundreds/thousands |
Q: What Linux features make containers possible?
A: Namespaces (isolate what the container can see — PID, network, mount, etc.) and cgroups (limit what the container can use — CPU, memory, I/O). Together they provide lightweight isolation with a shared kernel.
Q: How is a container different from a VM?
A: A VM virtualizes hardware — each guest runs its own kernel. A container virtualizes the OS — all containers share the host kernel. Containers are smaller (MB vs GB), start faster (ms vs minutes), but have weaker isolation.
Q: What’s the difference between a container image and a container?
A: An image is an immutable, read-only template — the blueprint. A container is a running instance of an image, with a writable layer added. You can have multiple containers from the same image.
Q: Why can’t you run a Linux container on a Windows kernel (without a VM)?
A: Containers share the host kernel. A Linux container needs Linux kernel interfaces (syscalls, namespaces, cgroups). Windows has different syscalls and a different kernel architecture. You need a Linux VM to run Linux containers on Windows.
Premium Content
Unlock Containers, Namespaces & CGroups and all premium lessons with a subscription.
From ₹199.99/year — See plans