Stage 4 · Provision
Container Fundamentals
Why Containers
Compare containers with virtual machines, reproducible environments, dependency isolation, and deployment portability.
The Problem
Before containers, deploying software meant dealing with inconsistent environments. A Python app that worked on a developer's macOS laptop might fail on a Ubuntu staging server due to different library versions, missing system packages, or OS-level differences. Teams spent hours debugging environment mismatches instead of building features.
Virtual machines solved part of this by encapsulating entire operating systems, but they introduced heavy resource overhead. Each VM required a full OS copy, hundreds of megabytes of storage, and minutes to boot.
Virtual Machines
A virtual machine emulates an entire computer. The hypervisor sits on the host OS and allocates CPU, memory, and disk to each guest VM. Each VM runs its own kernel, init system, and userland. This gives strong isolation but at a cost.
| Aspect | Virtual Machine | Container |
|---|---|---|
| Isolation level | Full (separate kernel) | Process-level (shared kernel) |
| Startup time | Minutes | Seconds or milliseconds |
| Disk footprint | Gigabytes | Megabytes |
| Density | Tens per host | Hundreds or thousands |
| Security model | Hardware virtualization | Kernel namespaces + cgroups |
Containers Defined
A container is a lightweight, isolated process that shares the host OS kernel. Instead of virtualizing hardware, containers virtualize the operating system. Linux namespaces restrict what a container can see, and control groups limit what it can consume.
Containers package the application code, runtime, system libraries, and dependencies into a single portable artifact. This artifact runs identically on any machine with a compatible container runtime — your laptop, a CI server, or a production cluster.
A container is not a lightweight VM. It is a regular Linux process with restricted visibility. You can see container processes on the host with ps aux and inspect their namespaces in /proc/[pid]/ns/.
Key Benefits
- Reproducibility — The same container image runs the same way everywhere, eliminating environment drift.
- Isolation — Each container gets its own filesystem, network stack, and process tree. Applications cannot interfere with each other.
- Portability — Build once, run anywhere. Containers are not tied to a specific OS, cloud, or architecture.
- Density — Because containers share the host kernel, you can run hundreds on a single machine without the overhead of full VMs.
- Speed — Containers start in milliseconds. This enables fast autoscaling, quick rollbacks, and rapid development cycles.
- Version control — Container images are versioned and immutable. You can roll back to any previous version instantly.
Container Use Cases
Containers are used across the entire software lifecycle. During development, they provide consistent environments and eliminate the works on my machine problem. In CI/CD, they run tests in isolated environments that match production. In production, they enable microservices, autoscaling, and zero-downtime deployments.
# This command produces identical output on macOS, Linux, and Windows
docker run --rm alpine cat /etc/os-release
# Run a PostgreSQL database in 2 seconds
docker run --rm -e POSTGRES_PASSWORD=test -d -p 5432:5432 postgres:16-alpineThe same Docker commands work identically on any platform. The Alpine container is about 7MB and starts in under a second.
When Not to Use Containers
Containers are not a universal solution. GUI applications, real-time hardware access, and workloads requiring kernel modules are poor fits. Some compliance environments also restrict containerization. Understanding these boundaries helps you make better architectural decisions.
Because containers share the host kernel, a kernel vulnerability affects all containers on the host. For maximum isolation between untrusted workloads, use separate VMs or dedicated hosts.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.