Containers don't sacrifice performance at all — that's a big part of why they are so popular. Containers are completely ordinary processes that happen to be nam

Containers don't sacrifice performance at all — that's a big part of why they are so popular. Containers are completely ordinary processes that happen to be namespaced and isolated through kernel mechanisms. They have direct access to hardware and all sorts of kernel services such as file systems and sockets. The only indirection involved is the overlay file system, but anything I/O-critical is usually mounted from the host. There's no runtime checking or proxying or anything, and therefore no runtime cost.