By john The most common mental model of a container is “a lightweight virtual machine.” It is a useful first approximation and a misleading second one. A container is not a small computer. It is an ordinary Linux process that has been given a restricted view of the system and a budget for resources. Understanding which of those two https://saborcitosrestaurant.com/ things is doing the work in any given situation will save you hours of confused debugging.
Two kernel features, two different jobs
Containers are built from two Linux kernel primitives that are frequently mentioned together and frequently confused. Namespaces control what a process can see. Cgroups control what a process can use.
Namespaces partition kernel resources so that one set of processes sees one set of resources while another set sees something completely different. A process in its own PID namespace believes it is process 1, the first process on the system, while the host kernel sees it as just another numbered process among many. The same trick applies to the network stack: a process in its own network namespace gets its own routing table and its own virtual interfaces, typically wired to the host through a virtual ethernet pair with one end on a host bridge.
Cgroups do something different. They limit, account for, and isolate resource usage — CPU, memory, disk I/O — for a collection of processes. Namespaces will not stop a container from consuming every byte of RAM on the host. Cgroups will.
What is not isolated
Here is the part that matters most, and the part the “lightweight VM” model obscures: the container shares the host’s kernel. A virtual machine runs a complete guest operating system with its own kernel, device drivers, and system libraries, sitting on top of a hypervisor. A container has none of that. It has the host’s kernel, viewed through a keyhole.
This has direct consequences. A kernel vulnerability is a host-wide vulnerability, not a per-container one. A container cannot run a different kernel version than its host. And the isolation boundary, while real, is a boundary enforced by kernel code rather than by hardware virtualisation — which is why “containers are a security boundary” is a claim that deserves qualification rather than assumption.
Why this shapes your decisions
Once you see containers as processes in a well-built cage rather than as miniature machines, several things stop being surprising. Containers start in milliseconds because starting one is essentially a system call plus a filesystem mount, not a boot sequence. Containers are cheap on memory because there is no duplicated guest OS. And when you need genuine kernel-level separation — running an untrusted workload, or needing a different kernel entirely — a container is the wrong tool, and a VM is the right one.
The isolation is real. It is just not the kind of isolation most people assume they are getting.