FrançaisGet started

Container versus virtual machine

What each one carries and shares, the comparison on seven criteria (kernel, isolation, weight, start-up, density, portability, guest system) and the constraints that decide between them.

  • 23 cards
  • 6 topics
  • Free
Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

  1. Concepts
  2. Questions
  3. Sort and link
  4. On the timeline
  5. Scenarios
  6. Understand

A few cards from the deck

  • Container: what is it?

    Show the answer

    A process (or group of processes) isolated from its neighbours, which sees its own file system, its own processes and its own network while running on the host's kernel.

    It carries no kernel and no simulated hardware, only the application and its libraries: that is what makes it light.

  • A developer runs docker run alpine uname -r on their Linux 6.8 host and gets 6.8.0-45-generic. Why?

    • The container has no kernel of its own: it uses the host's
    • The alpine image carries a kernel whose version is copied from the host at start-up
    • Docker emulates the host kernel in a small hidden virtual machine on Linux
    • The uname command is intercepted by Docker, which answers with the host's version
    Show the answer

    The container has no kernel of its own: it uses the host's

    A Linux container is a host process, isolated by namespaces. The alpine image only holds files (tools, libraries), never a kernel.

  • Inside a container, the command uname -r shows the same version as on the host, because the container uses ….

    Show the answer

    Inside a container, the command uname -r shows the same version as on the host, because the container uses the host's kernel.

    Inside a virtual machine, uname -r shows the guest kernel's version, which can differ widely from the host's.

  • Virtual machine: what is it?

    Show the answer

    A computer simulated by a hypervisor, with its virtual processor, memory and disks, on which a complete operating system is installed.

    It carries its own kernel: it can run a different system from the host's, at the price of a heavier start-up and footprint.

  • A hosting company runs the code of mutually distrustful customers in containers on the same hosts. What is the main risk, and what is the remedy?

    • A flaw in the shared kernel could let code escape a container; one virtual machine per customer answers it
    • Containers on the same host fight over the same port; the answer is to change ports
    • Containers are too slow to start for customers; the answer is a bigger host
    • Container images get mixed up between customers; the answer is to encrypt them
    Show the answer

    A flaw in the shared kernel could let code escape a container; one virtual machine per customer answers it

    All containers call the same kernel: a privilege-escalation vulnerability there endangers all of them. One virtual machine per customer puts a kernel and a hypervisor between them.

Study this deck