How is a container different from a virtual machine?

A virtual machine emulates hardware through a hypervisor and runs a complete guest operating system with its own kernel. A container is a normal process on the host that Linux isolates, and it shares the host kernel.

Isolation in containers comes from two kernel features:

• Namespaces give a process its own view of process ids, network, mounts, hostname and users.
• cgroups limit and account for CPU, memory and I/O.

Consequences:

• Containers start in milliseconds to seconds and are megabytes in size, while VMs boot an OS and are gigabytes.
• You can run many more containers than VMs on one host.
• The isolation boundary is weaker, since a kernel bug can affect all containers on the host. VMs have stronger isolation, so multi-tenant platforms often put containers inside VMs, or use sandboxes such as gVisor or Kata Containers.
• A Linux container needs a Linux kernel. On macOS and Windows, Docker Desktop runs a lightweight Linux VM to host them.

Containers package an application, and VMs package a whole machine.