Is a container a lightweight virtual machine?
No. A virtual machine runs its own kernel on virtualized hardware. A container is an ordinary process on the host kernel, isolated using Linux namespaces and limited using cgroups. That is why containers start in milliseconds and share the host's kernel, which also means a kernel vulnerability affects all of them.
Answered in
What docker run Actually Does: Daemon, containerd, runc, Namespaces, cgroupsA container is a normal Linux process with isolation and limits. Follow one docker run from the CLI through dockerd and containerd to kernel namespaces.
Read the full analysisOther questions this article answers
More developer tooling questions
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Developer Tooling beat.