image - package of filesystem, app code, configs, dependencies, runtime env (immutable) container - isolated running process created from an image
isolation level of docker process vs os process:
- still runs on same CPU
- still shares OS kernel
- both uses isolated virtual address space per process
- unlike regular OS process,
- isolated filesystem (mount what's needed)
- isolated network namespace (don't see other host os process networking)
- isolated process namespace (don't see other process' info)
- can set limits on cpu and memory (cgroups)
- can restrict system calls allowed (Seccomp)
- note:
- on mac os, docker engine will spin up a small linux VM (uses guest os (linux) kernel), managed by a hosted hypervisor - for all containers to run (just for docker easy compatibility for kernel API)
- related info: Containers VMs Hypervisor, process
portability
- contains all dependencies needed in the image, so same image can run reliably create containers that run across different types of machines