Docker and Kubernetes
How containers package software, how Kubernetes schedules and heals many of them, and an honest view of when you do not need it.
Containers versus virtual machines
A container is a normal process on a Linux host that the kernel has wrapped so it sees its own file system, process list and network, and cannot use more than its share of CPU and memory. Two kernel features do this:
- Namespaces give the process a private view (its own process ids, network interfaces, mounts).
- cgroups (control groups) cap resources, such as "at most 512 MB of memory".
A virtual machine (VM) is different: a hypervisor (software that splits hardware) runs a complete guest operating system with its own kernel on top.
| Container | Virtual machine | |
|---|---|---|
| Kernel | Shared with the host | Own kernel per VM |
| Size | Tens to hundreds of MB | Gigabytes |
| Start time | Milliseconds to seconds | Tens of seconds to minutes |
| Isolation | Weaker (shared kernel) | Stronger |
| Typical use | Packaging and running apps | Isolating tenants, running other operating systems |
The main benefit is not speed but sameness: the same image runs on your laptop, in CI and in production, which ends "works on my machine".
1 of 10