Step 01 of 06
Learn the concept
A container is not a tiny VM. It is one or more ordinary Linux processes wearing a set of kernel boundaries. That distinction explains why containers start in 80ms, why they can still see your kernel bugs, and why "works on my machine" was always a dependency problem with a better filing system.
The ideas this is made of
Namespaces make a private-looking world
A PID namespace lets Beacon see itself as process 1. A network namespace gives it its own interfaces and routing table. A mount namespace decides which filesystem tree exists at /. UTS, IPC, and user namespaces do the same for hostname, shared-memory names, and user IDs. Nothing copied a kernel. The kernel is filtering the view.
Cgroups turn politeness into limits
Without cgroups, a busy process can eat the host. Cgroups let the runtime say: this container gets 256MiB, two CPUs, 512 processes, or a specific block I/O share. When memory is exhausted, the kernel kills a process. That is the famous OOMKilled, not Docker being dramatic in the corner.
The union filesystem makes images cheap to share
Images are stacks of read-only layers. A container adds a thin writable layer on top. Ten containers from the same image do not copy ten operating systems; they share the read-only layers and write only their differences. That is why starting another Beacon container is cheap, and why writing SQLite into the container layer is disposable unless you mount a volume.
The VM comparison is honest only with the kernel named
A VM boots its own guest kernel on virtual hardware. A container uses the host kernel and starts a process. Containers are lighter because they skip the hardware and guest-kernel boundary. VMs isolate harder because a compromised guest must cross a hypervisor boundary. Neither is morally superior. They buy different failures.
docker run --rm --name tiny alpine:3.20 sh -c 'echo "inside pid=$$"; hostname; cat /proc/1/status | head -5'
docker inspect tiny 2>/dev/null || echo "container is gone"The Alpine process has its own hostname and process view while it runs, then disappears because --rm removes the container metadata. The host did not boot a new OS. It started sh with a different view of the same kernel.
Containers and VMs, without slogans
| Question | Container | Virtual machine |
|---|---|---|
Kernel | Shares the host kernel | Runs a guest kernel |
Startup | Usually milliseconds | Seconds to minutes |
Isolation | Namespaces, cgroups, LSMs | Hypervisor boundary |
Filesystem | Image layers plus writable top | Virtual disk |
Best fit | Repeatable app packaging | Strong OS separation |
What these are called on the job
Namespace — A kernel boundary that gives a process a private view of one resource family.
Cgroup — A kernel accounting and limit mechanism for CPU, memory, process count, and I/O.
Root filesystem — The directory tree mounted at
/for the process inside the container.OCI — The Open Container Initiative standards for image layout and runtime behaviour.