What a Container Is
"It works on my machine" is the oldest excuse in software. The notes app runs on your laptop with Python 3.12 and a certain library version; the server has something slightly different, and it breaks. Containers end that argument — and Kubernetes only ever runs containers.
The rule
A container is a boxed process: its own view, its own limits, a shared kernel.
A container is not a tiny computer. It is an ordinary process on the host, with two Linux features wrapped around it:
- Namespaces give it its own view: its own file system, process list, network interfaces and hostname. Inside, notes-web sees only itself.
- Control groups (cgroups) give it its own limits: how much CPU and memory it may use.
Every container on a machine shares that machine's kernel. That is the big difference from a virtual machine:
| Virtual machine | Container | |
|---|---|---|
| Brings its own kernel | Yes | No, shares the host's |
| Typical start time | Tens of seconds | Often under a second |
| Typical size | Gigabytes | Megabytes |
| Isolation | Stronger | Lighter |
Because the container carries its own files — the app, the Python version, the libraries — it runs the same way on your laptop and on the server.
docker run --rm -p 8080:8080 ghcr.io/example/notes-web:1.2That one line starts notes-web in a box. When the process exits, the container stops too.
The shortcut
Think "process in a box". For any question about containers ask: is this about the box's view (namespaces), the box's size (cgroups), or the shared floor (the kernel)?
The view
notes-web lists processes and sees only its own. notes-db does the same. Namespaces keep their views apart.
The trap is treating a container like a VM that you log into and patch by hand. Containers are meant to be replaced, not repaired: change the image and start a fresh one.
Drills
Answer fast — trust the rule.
What does a container share with every other container on the same machine?
Which Linux feature caps how much memory a container may use?
Why does a container usually start faster than a virtual machine?
notes-web has a bug in production. What is the container-minded fix?
Remember
- A container is a boxed process: its own view (namespaces), its own limits (cgroups), a shared kernel.
- Ask: view, size, or shared floor?
- Trap: treating containers like pets to patch. Replace them from a new image.