A program is a software package; a process is a running instance of it. When an executable runs, the operating system creates a process and a thread, loads the executable into memory, and starts executing its instructions. Processes let work run concurrently with other work. section 10.5 section 10.0
A process contains threads, but its memory is independent of other processes. Threads in one process share an address space; the operating system and CPU prevent separate processes from inspecting each other’s memory. That protection provides isolation, but it also means processes need operating-system support to exchange data. Network sockets are a common option; specialized interprocess communication can be faster but less portable. Rust channels and data protected by Arc<Mutex<_>> do not, by themselves, share data across processes. section 10.5 section 10.5.3
A container extends process isolation to resources beyond memory. Ordinary processes share a filesystem; containers can have separate filesystems and network resources. These protections are called namespaces. section 10.5.5
Figure 10.5 Trade-offs relating to different forms of task isolation in computing. In general terms, increasing the isolation level increases the overhead.
Compare forms of task isolation: greater isolation generally brings greater overhead. section 10.5
