Isolation without full virtualisation.
WHAT A CONTAINER IS
A process isolated by kernel features, with its own view of the file system, network and processes.
WHAT IT SHARES
The host's kernel.
WHAT THAT MEANS
Far lighter than a virtual machine, starting in moments.
WHAT IT ALSO MEANS
Weaker isolation, since a kernel vulnerability affects everything on the host.
WHAT THAT IMPLIES FOR MULTI-TENANT HOSTING
Containers alone are not sufficient isolation between untrusted customers.
WHAT TO USE INSTEAD
Virtual machines, or containers within per-customer virtual machines.
WHAT CONTAINERS SUIT
Packaging and deploying applications Consistent environments between development and production Density for trusted workloads
WHAT SYSTEM CONTAINERS ARE
Containers running a full system environment, used like lightweight machines.
WHERE THEY APPEAR
Virtualisation platforms offering them alongside virtual machines.
WHAT THEY SUIT
Internal workloads where the kernel is shared safely.
WHAT TO BE CAREFUL WITH
Running as a privileged user inside Mounting host paths Excessive capabilities
WHAT TO MONITOR
Resource use per container, since limits are easily omitted.
