KCNA — Containers vs VMs

3 minute read

Containers vs VMs

Understanding the difference between containers and virtual machines is fundamental to container orchestration.

Side-by-Side Comparison

┌── Virtual Machine ──┐     ┌──── Container ─────┐
│                      │     │                     │
│  ┌──────────────┐    │     │  ┌──────────────┐   │
│  │     App      │    │     │  │     App      │   │
│  ├──────────────┤    │     │  ├──────────────┤   │
│  │   Binaries   │    │     │  │   Binaries   │   │
│  ├──────────────┤    │     │  └──────┬───────┘   │
│  │  Guest OS    │    │     │         │           │
│  │ (Full Linux) │    │     │  Container Runtime  │
│  └──────┬───────┘    │     │  (containerd)       │
│         │            │     │         │           │
│    Hypervisor        │     └─────────┼───────────┘
│    (VMware, KVM)     │              │
└──────────┼───────────┘     ┌────────┴──────────┐
           │                 │   Host OS Kernel   │
    ┌──────┴───────┐         └───────────────────┘
    │  Host OS     │
    └──────────────┘

Key Differences

Aspect Virtual Machine Container
Isolation Full OS-level (hardware virtualization) Process-level (kernel namespaces, cgroups)
OS Each VM runs its own guest OS Shares host OS kernel
Size Gigabytes (includes full OS) Megabytes (just app + dependencies)
Startup time Minutes Seconds
Resource usage Heavy (full OS overhead per VM) Lightweight (shared kernel)
Density 10s of VMs per server 100s-1000s of containers per server
Portability Tied to hypervisor format Runs anywhere with a container runtime
Security isolation Stronger (separate kernels) Weaker (shared kernel)

How Containers Work

Containers use two Linux kernel features for isolation:

Namespaces (Isolation)

Each container gets its own isolated view of:

Namespace What It Isolates
PID Process IDs — container sees only its own processes
Network Network interfaces, IP addresses, ports
Mount Filesystem mount points
UTS Hostname
IPC Inter-process communication
User User and group IDs

cgroups (Resource Limits)

Control groups limit how much resource a container can use:

Resource What cgroups Control
CPU How much CPU time the container gets
Memory Maximum memory the container can use
I/O Disk read/write bandwidth
Network Network bandwidth allocation

Container Images

A container image is a read-only template used to create containers:

Concept Details
Image Read-only template with app code, runtime, libs, dependencies
Layer Images are built in layers; each instruction adds a layer
Registry Where images are stored and pulled from (Docker Hub, ECR, GCR)
Tag Version identifier (e.g., nginx:1.25, nginx:latest)

Image Layers

┌──────────────────┐
│    App code      │  ← Layer 4 (your application)
├──────────────────┤
│  Dependencies    │  ← Layer 3 (npm packages, pip packages)
├──────────────────┤
│  Runtime         │  ← Layer 2 (Node.js, Python, Java)
├──────────────────┤
│  Base OS         │  ← Layer 1 (Alpine, Ubuntu, Debian)
└──────────────────┘

Layers are shared between images — if two images use the same base, the base layer is stored only once.

When to Use Each

Use Case Best Choice Why
Running microservices Containers Lightweight, fast startup, easy to scale
Running legacy monolithic apps VM or Container Depends on dependencies and compatibility
Full OS isolation needed VM Separate kernel, stronger security
Maximum density Containers Much lower overhead per instance
Different OS requirements VM Containers share the host kernel
Development environments Containers Quick to spin up, identical to production

Containers and Kubernetes

Kubernetes orchestrates containers but doesn’t run them directly:

Kubernetes → CRI → Container Runtime (containerd) → runc → Container

Kubernetes manages the lifecycle:

  • Scheduling: Which node runs the container?
  • Scaling: How many instances?
  • Healing: Restart crashed containers
  • Networking: Route traffic to containers
  • Storage: Attach persistent storage

Key Takeaways for the Exam

  • Containers share the host OS kernel; VMs have their own guest OS
  • Containers use Linux namespaces (isolation) and cgroups (resource limits)
  • Containers are MB-sized and start in seconds; VMs are GB-sized and start in minutes
  • Container images are built in layers that can be shared
  • VMs provide stronger isolation (separate kernel); containers provide better density
  • Kubernetes doesn’t run containers directly — it uses container runtimes via CRI

What’s Next?

Let’s dive deeper into container runtimes.

Container Runtimes →

Updated:

You may also enjoy