Part I · How it works
7.1 What a container really is
alsocontainercontainersdockerpodmandocker runcontainerizationocirunclxccontainer vs vmpid 1 in container
TL;DR
- A container is a group of ordinary processes on your kernel. Nothing
is emulated:
uname -rinside shows the host's kernel. - Three kernel features make them feel apart: namespaces (what they see), cgroups (what they may use) and capabilities and seccomp (what they may do). An image gives them their own files.
- So containers start in milliseconds and cost little, but they all depend on the host's kernel.
docker run --rm -it alpine sh # then: ps, hostname, uname -r
ps -ef --forest # on the host: the same processes
On your machine
$ atfq 7.1 Here no container or virtual machine detected Isolated none: the host's namespaces (pid, user, uts, ipc, cgroup, time) Can run VMs with KVM (/dev/kvm) · containers with Docker Overlays 1 overlay mount: container layers, usually
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- Your program as PID 1 doesn't stop on SIGTERM unless it handles it:
docker stopwaits 10 seconds, then kills it.--initadds a tiny init. - A container can't run a different kernel: Linux images only, and kernel modules or sysctls come from the host.
- On a Mac or Windows, Docker and Podman run Linux in a virtual machine, and the containers inside it.
- Anything written inside a container is gone when it's removed, unless it's in a volume (7.3).
Deep dive 2 questions
What does docker run actually do?
The engine unpacks the image's layers, stacks them as the root
filesystem, then asks a runtime (runc or crun) to start the process:
it creates new namespaces, puts the process in a cgroup with its limits,
drops capabilities, applies a seccomp filter of allowed system calls,
and calls exec. From then on it's just a process the kernel schedules
like any other.
Container or virtual machine?
A VM runs its own kernel on emulated hardware: stronger isolation, any operating system, more memory and a slower start. A container shares the host's kernel: light and fast, but a kernel flaw affects them all. Clouds often combine them: containers inside small VMs (7.4).