A container is an operating-system-level form of virtualisation that isolates one or more processes and gives them their own execution context.
A process and its context
The kernel mediates between programs and a machine’s resources: processes, networking, sockets, filesystems and devices. It also enforces permissions and coordinates access to shared resources.
The set of resources visible to a process is its execution context. In a traditional system, processes share the machine’s view. Linux isolation mechanisms can give groups of processes a different view of selected resources.
Containers and virtual machines
A virtual machine emulates hardware and runs its own kernel. A container shares the host kernel while separating aspects of its processes’ context. It can therefore start quickly and use fewer resources than a virtual machine.
That difference also defines its isolation boundary: containers share a kernel, so they are not equivalent to virtual machines and must be secured as processes that depend on the same operating system.
Linux’s role
Linux builds isolated views using namespaces and other kernel mechanisms. Namespaces separate resources such as process identifiers, networking, mount points and hostnames; control groups organise and limit resource consumption.
Together, these capabilities make it possible to package applications and their dependencies into reproducible units without virtualising an entire machine.
Further reading
PID and UTS namespaces illustrate how the kernel presents different contexts to different processes. Read the first part of our Linux namespaces series about process isolation, then the second part about hostnames.