Containers on Linux: namespaces and cgroups

In short: A container is not a small computer but a normal Linux process with blinkers: namespaces limit what it sees, cgroups how much it may consume.

In more detail: Containers share the host’s kernel. This makes them lightweight and fast but less strongly isolated than virtual machines.

In detail

• Namespaces: own view of processes (PID), network (net), file systems (mnt), users (user), hostname (uts), IPC, cgroup.
• cgroups: limit and measure CPU, memory, I/O, number of processes.
• Overlay file system: an image consists of layers, the container adds a writable one on top.
• Image and container: image = immutable template, container = running instance.
• Runtimes: containerd, CRI-O, runc, crun. Tools: Docker, Podman, nerdctl.
• Security: rootless containers, seccomp filters, capabilities, AppArmor/SELinux (SELinux and AppArmor). A container escape gives access to the host’s kernel.
• Orchestration: Kubernetes manages many containers on many machines.
• Difference to a VM: no own kernel instance, no own hardware emulation.

See also: Virtualisation with KVM and QEMU, Podman and Docker compared