Docker's killer feature is the packaging mechanism. A Docker image is like a virtual machine image and contains an executable environment, sometimes sans kernel

Docker's killer feature is the packaging mechanism. A Docker image is like a virtual machine image and contains an executable environment, sometimes sans kernel since the host's kernel is used. It always includes a userland, but usually stripped down to support the bare minimum (busybox-ish). A "container" is simply a process that has some extra annotations on it, which various systems understand to represent some type of "namespacing" or information about the domain in which the process is allowed to operate. In Docker, these are implemented via the Linux cgroups mechanisms, which offers these and various types of annotations, including annotations that the kernel understands to constrain resource usage, etc. I don't know the details of the kernels well enough to discuss this next part in detail, but Linux containers implemented via cgroups are generally considered a "weak" security barrier, i.e., there are ways in which the isolation leaks out. illumos calls containers "zones" and is understood to have a stronger security/process isolation barrier, and I believe the same is true for FreeBSD jails, etc. "Containers" are a very old idea. Docker is an attempt to dumb them down for the masses by pretending that they're actually virtual machines and making it easy to "push" or "pull" the zip files^W^WDocker images. This assumption has caused many terrible container-based deployments. Most of the people running around tooting the horn of Docker and Kubernetes no doubt maintain these misconceptions and very superficial comprehensions of what's happening under the covers, and that's why they believe it's so magical and simple. Engineers who are trying to solve actual problems in a consistent, repeatable, and reliable manner will avoid any unnecessary complications -- including Kubernetes and/or Docker -- unless they are truly warranted by the unique circumstances in play, rather than seeking them out because they need a new flashy bullet point on their resume.