Also known as: Linux container · OCI container · Docker container
A container is a process or group of processes running in isolation on a shared kernel, using namespaces for visibility isolation and cgroups for resource limits, packaged with its own filesystem and dependencies.
Containers are not lightweight virtual machines. A VM runs its own kernel on virtualised hardware; a container is ordinary processes on the host kernel with restricted views. That difference explains both the startup speed advantage and the weaker isolation guarantee.
For workloads requiring stronger boundaries — untrusted multi-tenant code — sandboxed runtimes such as gVisor or lightweight VMs like Firecracker reintroduce a kernel boundary while retaining much of the container workflow.
Namespace
A Linux namespace is a kernel feature that gives a process an isolated view of a particular system resource — process IDs, network interfaces, mount points, hostnames — forming the primary isolation mechanism behind containers.
cgroups
cgroups (control groups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage — CPU, memory, disk I/O, network — of a group of processes.
seccomp
seccomp is a Linux kernel feature that restricts which system calls a process may make, reducing the kernel attack surface available to a compromised or untrusted program.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
Linux Distribution
A Linux distribution is a complete operating system built around the Linux kernel, bundling it with system libraries, a package manager, default utilities, and a curated set of software, along with policies for how all of it is maintained and updated.
SELinux / AppArmor
SELinux and AppArmor are Linux mandatory access control systems that confine processes to explicitly permitted actions, so that even a process running as root is limited to what its policy allows.