Container

Problem

VMs provide isolation, but every VM includes an entire operating system. For many applications that's unnecessarily heavy.

Solution — Container

Containers isolate processes while sharing the host kernel. The kernel is the core of an operating system: it manages CPU time, memory, and hardware access for applications. For example, when an app reads a file, the kernel checks permissions and retrieves the data through the storage driver.

App A container ─┐
App B container ─┼→ Host kernel
App C container ─┘

Core idea: containers provide lightweight application isolation without a separate kernel per application.