An operating system kernel is the privileged core that executes system-level operations and manages access to hardware. Containers share the host operating system’s single kernel: their system calls reach that kernel, which executes instructions on the host CPU. Kernel-provided isolation keeps applications separated even though they use the same kernel. section 2.1.1
The kernel creates an important distinction between containers and virtual machines:
- A virtual machine runs its own operating system and kernel; a hypervisor forwards the guest kernel’s instructions to the physical CPU. section 2.1.1
- Containers avoid a separate guest kernel and CPU virtualization, reducing runtime overhead and allowing applications to start without booting additional system processes. section 2.1.1
- A container image does not include the Linux kernel, so required kernel versions or modules must exist on the host. section 2.1.2
Why a container may fail on another host
A container that requires a particular kernel module can run on a computer where that module is loaded and break on another computer where it is missing. CPU architecture also matters: an application compiled for x86 cannot run on an ARM computer merely because Docker is installed. section 2.1.2
Figure 2.3 The difference between running applications on bare metal, in VMs, and in containers
Compare three applications running directly on bare metal, inside virtual machines, and inside containers to see how kernel sharing and isolation differ. section 2.1.1
