04.03 · Concept
Containers
Take a container apart into namespaces, cgroups and a root filesystem, so it stops being a black box.
A container is a Linux process given isolated namespaces, resource controls, and a chosen root filesystem. Namespaces change what it can see, cgroups constrain what it can consume, and image layers provide the files it runs against. That model explains networking, memory kills, writable layers, and why containers are not small virtual machines.
What this lesson answers
- what is a container really made of
- how do namespaces and cgroups isolate containers
- why are containers not lightweight virtual machines
Notes
Containers — Containers exist to run a process with isolated views of the machine plus bounded resources and a packaged filesystem; without namespaces, cgroups, and a root filesystem, one app can see host processes, consume all CPU or memory, or depend on missing host files.
Key Concepts: - A Linux container is not a lightweight VM: it is usually a normal process started with namespace flags such as , , , , , and often .
References
Common questions
- What actually separates a container from the host?
- The separation comes from Linux kernel features, not a separate guest operating system. Namespaces give the process its own view of things like processes, mounts, networking and host names. Cgroups track and limit resource use. A root filesystem from an image supplies the files the process sees when it starts.
- Why does PID 1 matter inside a container?
- The first process inside a PID namespace has special responsibilities. If it does not handle signals and reap child processes properly, shutdown can be unreliable and zombies can build up. Many application runtimes were not designed to act as an init process, so production containers often add a tiny init wrapper.
- What happens when a container exceeds its memory limit?
- A container memory limit is enforced by the kernel through cgroups. If the process goes beyond that boundary, it can be killed even when the physical machine still has spare memory. From the application side this often looks like an abrupt termination rather than a catchable allocation failure.
Short definition: what is Containers?