Docker containers
OS-level isolation · shared host kernel
Ready in 0.4 s
Container runtimeimages · namespaces · cgroups
Host operating systemone shared kernel
HardwareCPU · memory · storage
Run the same app two ways
Containers share a kernel. VMs bring their own.
Change the workload, reveal every layer, and simulate startup. The numbers are illustrative, but the architecture is real.
Container and virtual machine comparison lab
Virtual machines
Hardware virtualization · one guest OS each
Ready in 45 s
Hypervisorvirtual CPU · memory · devices
HardwareCPU · memory · storage
Illustrative host cost for this workload
Choose the boundary
Isolation is the real tradeoff.
Containers isolate processes while sharing the host kernel, so they are small and fast. Virtual machines isolate an entire operating system behind virtual hardware, so they carry more overhead but can run different kernels and provide a stronger default boundary.
Choose containers when
- You need fast scaling and dense hosts
- The workload can share the host kernel
- You want portable, reproducible images
Choose VMs when
- You need a different operating system
- Kernel-level isolation is important
- You are running legacy or privileged workloads
Try it locally
Your first container takes one command.
$ docker run -d -p 8080:80 --name web nginx
# Download the image, create an isolated process, and publish port 8080.
$ docker ps
# Inspect the running container.
$ docker stats web
# Watch CPU and memory usage.
$ docker rm -f web
# Stop and remove it cleanly.
# Download the image, create an isolated process, and publish port 8080.
$ docker ps
# Inspect the running container.
$ docker stats web
# Watch CPU and memory usage.
$ docker rm -f web
# Stop and remove it cleanly.