Basically, a VM pretends it has a cpu and a disk and ram, a container pretends that it has a root directory and ports and all of that stuff. Like always it's a

Basically, a VM pretends it has a cpu and a disk and ram, a container pretends that it has a root directory and ports and all of that stuff. Like always it's a leaky abstraction and isn't usually sufficient for security purposes (ie. two containers on the same system might be able to talk to each other if you abuse the system) but it's good enough for most purposes and provides much better resource utilization than a bunch of VMs.