Part I · How it works

7. How containers and virtual machines work

1. 7.1What a container really isA container is a group of ordinary processes on your kernel. Nothing is emulated: uname -r inside shows the host's kernel.
2. 7.2Namespaces: a private view of the systemA namespace gives a process its own copy of one global thing: process IDs (pid), mounts (mnt), network (net), hostname (uts), IPC, users, cgroups, clocks (time).
3. 7.3Images, layers and overlayfsAn image is a stack of read-only layers, one per build step, plus some settings (command, environment). Layers are shared between images.
4. 7.4Virtual machines and hypervisorsA virtual machine runs a whole operating system, kernel included, on virtual hardware. The hypervisor shares the real CPUs, RAM and devices between machines.
5. 7.5Root in a container: users, capabilities and the docker groupWithout user namespaces, root in a container is root on the host, held back only by namespaces, dropped capabilities and seccomp.