What is the difference between containers and virtual machines?

I want to comprehend all that differ a container from a virtual machine. A filesystem with all operational system can be observed for both of these virtualization methods. But in a Docker container, e.g. centos 5.x, if I exec uname -a in container's shell, the output shows my host kernel version. How does it works and the main differences from a classic virtual machine (vmware, virtualbox, xen, etc)?


Both forms allow multiple operating systems to run on a single physical machine.

With containers, these operating systems are isolated (they have their own file systems, processes, libraries including the libc, IP address, etc.) but they are nevertheless sharing the very same kernel. That's the reason why uname -a showed your host kernel version.

With traditional virtualization, the operating systems have each one their own kernel running. These multiple kernels are not running on top of the real hardware, but on top of a virtualized hardware provided by a piece of software called an hypervisor. This is an extra layer compared to container based virtualization.

Each kind of virtualization has its strenghts and weaknesses. Containers are more limited in the choice of operating systems, the container one must be supported by the running kernel (e.g.: Solaris zones on Solaris, LXC on Linux, WPAR on AIX) although technically, nothing forbid kernel developers to implement the support for "alien" userlands (e.g.: lxbrand = Linux zones on Solaris 10 and SmartOS, or more recently Ubuntu runtime on Windows 10) while with hypervisors, the operating system needs only to be supported by the virtual hardware, which allows much heterogeneous configurations (e.g. : Linux 32 bit and 64 bit kernels, *BSDs, Solaris, Windows, Mac OS X, ...)

The major advantage of containers is they are much lighter, the application performance is essentially the same as what it would be with a true bare metal OS installation. New container instantiation is much faster because there is no extra kernel to boot, and the virtual environment density can be much higher because there are no extra kernels to run.

Note that Docker is not a container implementation. Docker is a building/packaging/distribution standard for applications running in containers and include an engine to run them and recently added an orchestrator too. This engine plays a role similar to the one of an hypervisor, but for applications on containers.


A good starting point would be to read the Wikipedia article:

Operating-system-level virtualization is a server virtualization method in which the kernel of an operating system allows the existence of multiple isolated user-space instances, instead of just one. Such instances, which are sometimes called containers, software containers, virtualization engines (VEs) or jails (FreeBSD jail or chroot jail), may look and feel like a real server from the point of view of its owners and users.

On Unix-like operating systems, this technology can be seen as an advanced implementation of the standard chroot mechanism. In addition to isolation mechanisms, the kernel often provides resource-management features to limit the impact of one container's activities on other containers. [...]


I want to comprehend all that differ a container from a virtual machine.

With virtualization technology, the package that can be passed around is a virtual machine and it includes an entire operating system as well as the application. A physical server running three virtual machines would have a hypervisor and three separate operating systems running on top of it.

By contrast a server running three containerized applications as with Docker runs a single operating system, and each container shares the operating system kernel with the other containers. Shared parts of the operating system are read only, while each container has its own mount (i.e., a way to access the container) for writing. That means the containers are much more lightweight and use far fewer resources than virtual machines.

What else do you want to know? Which details are you missing, exactly?