This is a big over-simplification, but I think it's a good mental model: Think of a container as a fancy chroot. Imagine that: 1. You have a whole separat

This is a big over-simplification, but I think it's a good mental model: Think of a container as a fancy chroot. Imagine that: 1. You have a whole separate Linux installation in some random folder. 2. You ask your OS to launch some process, and to "trick" the process into thinking that "$YOUR_FOLDER" is actually "/". 3. You maybe also ask your OS to add some extra isolation (network, devices, /proc, etc). 4. The term "container" refers to the chroot, the isolation rules, and usually the process-tree running inside of it. 5. While a container is alive, you can also ask the OS to run some other programs that exist inside of the container's sandbox Docker is a tool that creates and manages containers. In Docker's view of the world: - Containers are made by extracting .tar.gz files into some folder and asking the OS to create a sandbox where that folder is a "fake" root directory. - Those .tar.gz files are called "images". - Docker can download images from the internet, or you can build your own by asking it to follow the steps contained in a Dockerfile.