Docker interview question · Most asked
What is a container, and how does it differ from a virtual machine?
Summary
A container is an isolated process (or group of processes) on the host's Linux kernel, isolated with namespaces (what it can see: processes, network, mounts, users) and limited with cgroups (how much CPU, memory and I/O it may use), running from an image's filesystem. A virtual machine runs a full guest operating system with its own kernel on a hypervisor.
Longer Answer
Containers start in milliseconds, use little overhead and pack densely, but share the host kernel, so isolation is weaker than a VM's: a kernel vulnerability can affect every container on the host. VMs give stronger isolation and can run different kernels or operating systems. Many platforms combine them: containers inside VMs, or micro-VMs per container (Firecracker in AWS Fargate and Lambda, Kata Containers) for stronger isolation.
On macOS and Windows, Docker Desktop runs containers inside a lightweight Linux VM.
Key Points
- Namespaces isolate; cgroups limit.
- Shared host kernel.
- Fast and light, weaker isolation than VMs.
- Micro-VMs for stronger isolation.
Explanation
What interviewers look for
Correct mention of namespaces and cgroups, and the shared-kernel security trade-off.
More most-asked Docker questions
- How do you secure Docker containers and images?
- What are multi-stage builds, and why use them?
- What is the difference between an image and a container, and how do image layers work?
- How does Docker build caching work, and how do you order a Dockerfile to use it well?
- What are Dockerfile best practices for production images?
- ARG or ENV: what is the difference, and how do you pass secrets into a build safely?
- CMD or ENTRYPOINT: what is the difference, and what are exec and shell forms?
- How do you make Docker images smaller?