English
Menu

What is Container?

A unit of execution that bundles an application with the libraries and settings it needs and runs it isolated from other processes while sharing the host OS kernel. On Linux it is built from namespaces, which separate the view of process IDs, the network, mounts and so on, and cgroups, which limit the use of CPU and memory. It is lighter and faster to start than a virtual machine that boots a whole OS, but because it shares the kernel it cannot run a kernel of a different kind of OS from the host. Containers are created from container images and are created and managed with tools such as Docker and Kubernetes.

Japanese name: コンテナ

Container appears in 19 practice questions across 2 topics, including Cloud and Container Basics, OS & Hardware.

Field: Cloud and Container Basics

How it differs from a virtual machine

Virtual machines each run an OS, kernel included, on a hypervisor. A container does not boot an OS; it runs as an isolated process on the host kernel, so it often starts in under a second, and many can be packed onto one machine. On the other hand, its isolation relies on kernel features and is not as strong as that of a virtual machine. Where strong isolation is needed, containers are sometimes run inside lightweight virtual machines.

A container's file system

A container's file system is a writable layer for that container stacked on the read-only image layers. When a file from the image is modified, it is first copied into the writable layer and then changed (copy-on-write). The writable layer disappears when the container is removed, so data that must be kept is placed in external storage such as a volume.

Designing for disposability

Containers are designed on the assumption that a broken one is not repaired but recreated from the image and replaced. Configuration is supplied from outside, for example through environment variables, logs are written to standard output for the platform to collect, and state is kept in databases or storage. This makes it easy to change the number of containers or to swap in a new version.

Try it: questions about Container

Which correctly distinguishes containers from virtual machines?

  1. AEach container has its own OS kernel, while virtual machines share a kernel
  2. BContainers run on a hypervisor, while virtual machines run using only OS features
  3. CContainers share the kernel; each VM runs its own OS
Show answer and explanation

Answer: C. Containers share the kernel; each VM runs its own OS

Containers share a single OS kernel while partitioning file-system views, processes, networking and resource limits by group. Since no whole OS is booted, they are lightweight and start quickly. Virtual machines run on a hypervisor, each with its own OS including a kernel, which is heavier but gives stronger isolation and allows different OS types. Kernel sharing belongs to containers; watch for options that reverse the two.

Among the Linux kernel features that make containers possible, which of the following correctly pairs namespaces and cgroups (control groups) with their roles?

  1. ANamespaces: separate what a process can see (process IDs, network, mounts, etc.); cgroups: limit and account for the use of resources such as CPU and memory
  2. BNamespaces: limit and account for the use of resources such as CPU and memory; cgroups: separate what a process can see (process IDs, network, mounts, etc.)
  3. CNamespaces: boot a separate kernel for each container to isolate them; cgroups: create a virtual CPU for each container and emulate the hardware
Show answer and explanation

Answer: A. Namespaces: separate what a process can see (process IDs, network, mounts, etc.); cgroups: limit and account for the use of resources such as CPU and memory

A container is an ordinary process running on the host kernel, isolated by two mechanisms. Namespaces split process IDs, the network, mounts (the view of the file system), the host name and so on into groups, so that the processes in a container see only their own share. Cgroups limit the CPU time and amount of memory a group of processes can use and account for their usage. Both are kernel features, so a container neither boots another kernel nor emulates hardware.

FAQ

Can a container use a different Linux distribution from the host?

Yes. An image contains user-space files such as commands and libraries, so they can come from another distribution. The kernel, however, is shared with the host, so uname -r shows the host kernel and features the host kernel lacks are unavailable.

Why can Linux containers run on Windows or macOS?

Tools such as Docker Desktop run a small Linux virtual machine and execute the Linux containers in it. Linux containers always need a Linux kernel somewhere.

Container in the explanations

Questions that mention Container (19)

  1. Which correctly distinguishes containers from virtual machines?
  2. Among the Linux kernel features that make containers possible, which of the following correctly pairs namespaces and cgroups (control groups) with their roles?
  3. On a Linux host, Docker is used to start a container from an image based on a different distribution from the host, and uname -r (which shows the kernel release) and cat /etc/os-release (which shows information about the distribution) are run inside it. Which of the following correctly describes the results?
  4. Which of the following correctly describes the relationship between a container image and a container?
  5. Inside a container started from an image, the configuration file /etc/app.conf, which is part of the image, is modified. Which of the following correctly describes what happens with Docker's usual storage mechanism (such as overlay2)?
  6. For the Dockerfile above, which of the following correctly pairs the command executed when the image is built with docker build and the command executed when a container is started with docker run?
  7. An image named pinger, built from the Dockerfile above, is started with docker run pinger example.com. Which of the following is the command executed in the container?
  8. A container is started with the command above from the image nginx, a web server that listens on port 80. The host's IP address is 192.0.2.10, and there are no restrictions such as a firewall. Which of the following is the URL to use to reach this web server from a browser on another PC on the same network?
  9. In Docker, which of the following correctly describes named volumes and bind mounts, used to keep data written by a container?
  10. In Kubernetes, which of the following is the smallest unit that is deployed and managed, grouping one or more containers that share the same IP address and volumes?
  11. A web application cannot handle requests for about 60 seconds after starting, while it loads its cache, and returns 503 from /ready during that time. Which of the following correctly describes the effect of adding the settings above to the Pod's container?
  12. In a Deployment whose Pod containers have the settings above, four Pods are running, each using 400m (0.4 cores) of CPU. The HorizontalPodAutoscaler's target CPU utilization is 60%, and the required number of Pods is computed as ⌈current number × current utilization ÷ target utilization⌉. Which of the following is the required number of Pods?
  13. In Kubernetes, which of the following correctly describes the resource requests and limits set for a container?
  14. A node has allocatable resources of 4 CPU cores and 8 GiB of memory. Each Pod's container has requests of 500m CPU and 1.5 GiB memory and limits of 1 CPU core and 2 GiB memory. There are no other Pods and no system reservations. Which of the following is the maximum number of Pods that can be placed on this node?
  15. As shown above, the database connection target is not written into the image but passed as an environment variable when the container starts. Which of the following is the most appropriate main advantage of this design?

Books on Cloud and Container Basics Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Pod Docker Kubernetes Environment variable Hypervisor CPU time Container image Copy-on-write JSON (JavaScript Object Notation) Argument

Back to the glossary