4 ms·
That's not usually complete. Minimally, it's a process in its own PID namespace. But assuming it's an OCI container, which will be the case if you're using any
by nonameiguess 5y ago
That's not usually complete. Minimally, it's a process in its own PID namespace.
But assuming it's an OCI container, which will be the case if you're using any common managed container runtime and not rolling your own, it's a process in its own user namespace, mount namespace, UTS namespace, cgroup namespace, IPC namespace, and time namespace. It's assigned its own hostname and IP in the new UTS namespace. It runs in a chroot in the new mount namespace to a root filesystem assembled via overlay with a single writeable layer on top of N read-only layers shared with any other container that is launched from the same image. It gets bind mounts, kernel VFS mounts, an environment, and an entrypoint command from a config file colocated with the root filesystem in a container bundle created from the image defaults, system defaults, and command line overrides.
The simplest way to compare it to a VM is a container is the Linux kernel using namespaces and cgroups to scope the services and resources it presents to a single userspace process. A VM is a hypervisor presenting virtualized hardware and BIOS services to guest kernels.
- stuff4ben 5y agoYou're being a bit obtuse or maybe you just wanted to show off your knowledge a bit. I said basically the same, "it's a process... with namespaces and cgroups." If they can answer that and know what that means, I'm good and I go to my other interview questions. I'm not hiring a Docker developer or someone who needs to know the internals of Linux. I'm hiring SREs who manage and oversee Docker and Kubernetes production environments.
- sombremesa 5y agoTechnically you don’t need to know what a container “is” to oversee Docker and Kubernetes production environments (knowing that it’s not a VM is a plus, but then you already knew that by calling it a container rather than a VM). A container can just be a container, and you can leave it at that. If a zookeeper starts talking about jackdaws and crows in an interview, who’s the one being obtuse and trying to show off their knowledge? The important thing is that the animals are taken care of and the zoo visitors are happy.
- avgDev 5y agoI have apps running in docker and I also deployed apps to VMs. I would get this answer wrong according to OP. Honestly I don't see how this knowledge is necessary.
- stuff4ben 5y agoAn SRE responsible for Kubernetes and Docker production environments who doesn't understand the fundamentals of how they work wouldn't be of much use to me. Sure they can probably follow scripted runbooks but I want people who can deep dive into advanced trouble-shooting. TBF, there are uses for those that don't get it, but they're usually the lesser paid folks who work night and weekend on-call rotations.
- sombremesa 5y ago> I want people who can deep dive into advanced trouble-shooting In my experience, people who need to know every little thing rarely end up knowing every little thing, and are actually the absolute worst at fixing issues of high urgency - due to needing to know every little thing. I'd much rather have people who are able to learn fast on the fly. Those are the people who actually end up knowing the little things that are actually useful, as opposed to useless trivia.
- zekrioca 5y agoSo much to just say that a container is a VM without BIOS?
- deleted 5y ago[deleted]
- maccam94 5y agoNo. A container shares the same kernel with the host OS. It doesn't do any of its own hardware setup. At most the host kernel will create some virtual network interfaces and create a filesystem for it. The container's processes are the same as other processes on the host OS, just with some special accounting flags that govern how many resources they get and what they're allowed to see from the host. A VM host creates a guest environment with a bunch of virtual hardware devices and starts up the guest's kernel that talks to them through its own drivers. The guest does its own hardware initialization, formats and mounts its own block storage devices, does its own bootup and process scheduling, etc.
- zekrioca 5y agoIf a container shares the same kernel with the host OS, how can Docker containers run in different OSes? Are people saying that what Docker containers really are "Docker VMs"?
- remram 5y agoIf you mean "how can Docker containers based on Linux run on Mac/Windows hosts", they don't. There is a single VM running Linux and the containers run inside of that.
- maccam94 5y ago"Docker for Mac" and "Docker for Windows" generally spin up a local Linux VM to run containers, but all of the containers run inside a single VM. (I'm going to gloss over running Windows containers on Windows, which I believe operate more like Linux containers do on Linux).