A virtual machine (VM) virtualises hardware. A hypervisor runs several VMs, and each one boots its own full guest operating system, kernel included.
A container is just an ordinary process on the host, isolated using two Linux kernel features:
- Namespaces change what the process can see: its own process list (PID), network interfaces, filesystem mounts, hostname and users.
- cgroups (control groups) limit what it can use: CPU, memory, I/O.
All containers on a host share the host's kernel. There is no guest OS to boot.
| VM | Container | |
|---|---|---|
| Isolation | Strong: separate kernel | Weaker: shared kernel |
| Size | GBs (whole OS) | MBs (app + libraries) |
| Start time | Minutes or tens of seconds | Usually under a second |
| Different OS kernel | Yes | No: Linux containers need a Linux kernel |
That last row explains why Docker Desktop on Windows or macOS quietly runs a small Linux VM: Linux containers need a Linux kernel to share.
docker run --memory 256m --cpus 0.5 nginx # cgroup limitsThe trap: "Containers are lightweight VMs." They are not VMs at all; they are isolated processes. That is why they start fast, and also why a kernel bug can affect every container on the host.
In interviews: "Container vs VM?" Mention the shared kernel, namespaces for isolation, cgroups for limits, and the trade-off between density and isolation.