Container

A container is a lightweight, isolated runtime unit that bundles an application with its libraries, configuration, and other dependencies. Unlike a virtual machine, a container does not include a full guest operating system. Instead, it shares the kernel of the host operating system while remaining isolated from other containers.

How It Works

Containers rely on operating-system features rather than hardware virtualization. On Linux, namespaces isolate what a process can see (process IDs, network interfaces, mounts, users), and cgroups limit what it can use (CPU, memory, I/O). A container is started from a read-only container image by a container runtime. The runtime layers a writable filesystem on top of the image and applies the namespace and cgroup settings.

Because containers share the host kernel, they start in milliseconds and have far less overhead than virtual machines. Many containers can run densely on a single host.

Why It Matters

Containers solve the "works on my machine" problem by making the runtime environment portable and reproducible. The same image runs identically on a laptop, a CI runner, and a production cluster. This portability underpins modern cloud-native architecture, microservices, and continuous delivery. Containers also enable fine-grained resource control and rapid horizontal scaling.

The trade-off is weaker isolation than virtual machines, since a kernel vulnerability can affect all containers on a host. Security-sensitive workloads sometimes use sandboxed runtimes or microVMs to add a stronger boundary.

Related Terms

A container is instantiated from a container image and managed by a container runtime. In Kubernetes, containers are grouped into a pod. Image formats and runtime behavior are standardized by the OCI image specification.