IT 3300 : Virtualization

Containers — How They Work

From VMs to containers

  • A VM virtualizes hardware and boots its own kernel
  • A container virtualizes the OS and shares the host kernel
  • Result: containers are smaller, faster, and denser than VMs

VM vs. container

VM:                        Container:
+-----------+              +-----------+
| App       |              | App       |
| Libs      |              | Libs      |
| Guest OS  |              +-----------+
| (kernel)  |              (shares host kernel)
+-----------+              +-----------+
| Hypervisor|              | Container engine
+-----------+              +-----------+
| Host / HW |              | Host OS / HW

The Linux magic behind containers

  • Namespaces — isolate what a process can see
    (its own PIDs, network, mounts, hostname)
  • cgroups — limit what a process can use
    (CPU, memory, I/O)
  • Together: a process that feels like it has its own machine

Union / layered filesystems

  • Images are built in read-only layers
  • Containers add a thin writable layer on top
  • Shared layers are stored once on disk
  • This is why images are small and containers start instantly

OCI: the standard

  • Docker popularized containers, but the standard is OCI
    (Open Container Initiative)
  • Defines the image format and the runtime behavior
  • An OCI image built by Docker runs on containerd, Podman, CRI-O,
    and Kubernetes — vendor-neutral

Why containers won

  • Portable — build once, run anywhere OCI runs
  • Fast — start in milliseconds
  • Consistent — "works on my machine" becomes "works everywhere"
  • Efficient — high density, shared layers

Containers are not a security boundary (alone)

  • They share the host kernel — a kernel exploit escapes the container
  • Weaker isolation than a VM
  • Best practice: run untrusted workloads in a VM and a container
  • We'll cover container hardening in the security deck

Lab goals

  • On a Proxmox VM, confirm the kernel is shared (uname -r in a container
    matches the host)
  • Sketch, in your own words, the difference between a namespace and a cgroup