Courses Docker for beginnersDocker basics

Containers vs virtual machines

Why a container is lighter than a VM.

Beginner10 min · lesson 2 of 16

In plain terms

A virtual machine is a whole separate house with its own foundation, plumbing, and electricity. A container is an apartment in a shared building — it has its own locked door and rooms, but shares the building’s foundation and utilities (the host’s kernel). That sharing is why apartments are quicker to build and cheaper to run than houses.

To see what a container really is, compare it with a virtual machine. A VM uses a hypervisor to virtualize hardware, and on top of that virtual hardware runs a complete guest operating system — its own kernel, its own init, its own everything. That is heavy but strongly isolated: each VM is a full, separate computer. A container skips all of that. It virtualizes the operating system instead of the hardware, so every container on a host shares that one host kernel and ships only the files the app itself needs.

The two stacks, side by side

Virtual machines — a full OS each

App A / App B

the workloads

Guest OS ×N

a full kernel each — GBs

Hypervisor

virtualizes hardware

Containers — one shared kernel

App A / App B

the workloads

Docker engine

isolates processes

Host OS kernel

shared by all — MBs each

The difference is one line: a VM brings its own kernel, a container borrows the host’s.

What sharing the kernel buys you

Because there is no guest OS to boot, a container starts in well under a second where a VM takes tens of seconds to minutes. It measures in megabytes, not gigabytes, so a single host that might run a handful of VMs can run dozens or hundreds of containers. That density and speed are exactly why containers became the unit of modern deployment and the thing Kubernetes schedules.

The tradeoff

Sharing the kernel is also the catch. Two VMs are separated by a hardware boundary; two containers are separated only by kernel features (namespaces and cgroups, which you will meet later). That boundary is strong enough for most workloads but thinner than a VM’s, which is the entire reason container hardening exists. And because they share the kernel, Linux containers need a Linux kernel — on macOS and Windows, Docker quietly runs them inside a small Linux VM.

Shared kernel, thinner boundary

Keep this in the back of your mind as you learn: everything a container can do, it does through the host kernel. A container escape means reaching that kernel, which is why later courses spend so much effort dropping privileges and filtering what a container is allowed to ask the kernel to do.

What Docker is, and whyImages vs containers