What a Container Is — and Where LXC Fits

notes-api works on your laptop but fails on web1 because the server has a different Python version and a missing system library. Containers fix "works on my machine" by shipping the app together with its environment, and they do it far more lightly than a virtual machine.

The rule

A container is an isolated process sharing the host's kernel.

A virtual machine emulates a whole computer: a hypervisor runs a complete guest operating system, with its own kernel, on virtual hardware. Strong isolation, but each VM carries gigabytes and takes a while to boot.

A container is just a normal process on the host, fenced in by two Linux kernel features:

• Namespaces change what the process can see: its own process list (it believes it is PID 1), its own network interfaces, its own filesystem view, its own hostname.
• Control groups (cgroups) limit what it can use: CPU, memory, disk I/O.

No second kernel, so a container starts in about the time the program itself takes to start and adds almost no memory overhead. The cost: every container shares the host kernel, so isolation is weaker than a VM's, and a Linux container needs a Linux kernel. That is why Docker Desktop on macOS and Windows quietly runs a small Linux VM underneath.

There are two styles of container:

• System containers, such as LXC (and LXD/Incus built on it), behave like a lightweight VM: they boot an init system and run several services, and you manage them like a server.
• Application containers, such as Docker, package one application and its dependencies, start that one process, and are replaced rather than updated in place.

The shortcut

Ask two questions: own kernel? whole machine or one app?

• Needs its own kernel or a different operating system: VM.
• Shares the kernel but should feel like a full server: system container (LXC).
• Shares the kernel and runs one app: application container (Docker).

Drills

Answer fast — trust the rule.

Remember

• A container is an isolated process sharing the host's kernel.
• Shortcut: own kernel means VM; whole machine means LXC; one app means Docker.
• Trap: assuming container isolation is as strong as a VM's.