Containers and the Host Kernel

A container is a program running on your computer that has been given its own private view of files, process numbers and network, so that it behaves as if it had a machine to itself. It is not a separate computer. It runs directly on the kernel of the machine you already have: the core of the operating system, which starts programs and talks to the hardware.

The difference shows the first time you run one. The command below starts a container from alpine, a very small Linux image, prints a word, and removes the container again (--rm). time reports how long all of that took:

About a sixth of a second, and nothing booted. A virtual machine asked to do the same job would first start an operating system of its own, which takes tens of seconds. The container skipped that because it is an ordinary process (a running program) on the kernel that was already running. What makes it a container is that Docker starts that process with its own view of three things:

The filesystem comes from an image, a package of files that holds the program and everything it needs. Process numbers start again at 1, so the program cannot see the other programs on the machine. The network interface is its own, so the program can listen on a port (a numbered network endpoint) without colliding with anything else.

So a container starts in milliseconds and twenty of them fit on a laptop, because there is only ever one kernel running and each container costs little more than the program inside it.