Lesson 1 · Containers & Docker

What a container is (vs a VM)

An isolated process, not a little machine — and why that distinction wins interviews.

Your win: give the crisp, correct answer to "what is a container, and how is it different from a VM?" — the namespaces/cgroups answer, not the hand-wave.

The one-sentence definition

A container is a running process (or process tree) that the kernel has been told to isolate — it gets its own view of the filesystem, network, and process list, but it shares the host's kernel. Docker's own docs put it plainly: a container is "an isolated process for each of your app's components."¹ There is no guest operating system inside it.

The mental flip Stop picturing a tiny computer. Picture /server running on the host like any other process — except the kernel lies to it: "you are PID 1, this is your whole filesystem, this is your only network interface." That lie is the container.

How the isolation actually works

Two Linux kernel features do all the work — worth naming precisely, because interviewers listen for them:

Namespaces — isolation. Separate namespaces for PIDs, mounts (the filesystem), network, users, hostname, etc. Each gives the process a private view of that resource, so it can't see the host's or other containers'.
cgroups (control groups) — limits. They cap how much CPU, memory, and I/O the process may use, so one container can't starve the host.

These are defined by the OCI Runtime Spec, the open standard a container runtime implements.² That's why containers aren't "a Docker thing" — Docker, containerd, and Podman all run the same OCI containers.

Container vs VM — the table to memorise

	Container	Virtual machine
Isolates with	kernel namespaces + cgroups	a hypervisor + full guest kernel
Guest OS	none — shares host kernel	a full OS per VM
Starts in	milliseconds to seconds	seconds to minutes
Typical size	tens of MBs	gigabytes
Isolation	weaker (shared kernel)	stronger (separate kernel)

The trade is right there in the last two rows: containers are lighter and faster because they skip the guest OS, but that shared kernel is a thinner security boundary than a VM's.

Anchor — you already run dozens of these When you type ./local/run.bash start -s bob, you are not booting a machine. You are starting a container: the /server process from the new-backend:locally image, isolated on the local-manabie-network. The Postgres you learned in the Postgres course? Also a container — the db service in local/docker-compose.infra.yaml:2, sharing your Mac's kernel with ~25 backend services. That's why the whole stack fits on your laptop; twenty-five VMs would not.

On a Mac, there's one VM hiding Containers need a Linux kernel. On macOS, Docker Desktop runs a single lightweight Linux VM, and all your containers share that VM's kernel. So it's "many containers in one small VM" — not "one VM per container." Good to know, rarely asked.

Docker — “What is a container?”

Three short pages: what a container is, what an image is, and how they relate. The canonical mental model, straight from the source.

→ docs.docker.com — What is a container?
→ OCI Runtime Spec (namespaces + cgroups, the standard)

Check yourself (from memory)

Q1. The clearest description of a container is…

No guest OS — it's a host process the kernel isolates with namespaces and limits with cgroups.

Q2. Isolation of a container's filesystem and PIDs comes from…

Namespaces give a private view (PID, mount, net, …); cgroups do the resource limiting, not the isolation.

Q3. Versus a VM, a container is generally…

Skipping the guest OS buys speed and size; the cost is a shared kernel — a thinner security boundary.

"What is a container, and how does it differ from a VM?" — answer out loud.

recall, then click to reveal

A CONTAINER is an isolated PROCESS sharing the host KERNEL — Linux NAMESPACES give it a private view (filesystem, PIDs, network, …) and CGROUPS cap its resources. No guest OS. A VM runs a FULL guest OS on a hypervisor with its own kernel. So containers are lighter (MBs), start faster (ms–s), and pack more per host — at the cost of WEAKER isolation (shared kernel). Standardised by the OCI Runtime Spec, so they aren't Docker-specific. In this repo, every ./local/run.bash start -s <svc> process and the db Postgres are containers sharing one kernel.

Curious how a namespace actually hides PIDs, or why Docker Desktop needs a VM on your Mac? Ask me.

1. Docker — What is a container?

2. Open Container Initiative — Runtime Specification (namespaces & cgroups).