What a container really is

A container is a normal process on a Linux machine, started with a few kernel features that make it believe it is alone.

• Namespaces give the process its own view of process ids, network interfaces, mount points and hostname. Inside, your app sees itself as process 1 with its own network.
• Control groups (cgroups) limit how much CPU and memory it can use.
• A separate root file system comes from an image, so the process sees the files you packaged rather than the host's files.

That is why containers start in a fraction of a second: nothing is booted. A virtual machine, by contrast, emulates hardware and runs a full operating system kernel.

Images and containers

An image is a read only template: a file system plus metadata such as the default command and environment variables. A container is a running (or stopped) instance of an image, with a thin writable layer on top. You can start many containers from one image, just as you can start many processes from one program.

docker run --rm -it python:3.13-slim python -c "print('hello from a container')"

This pulls the python:3.13-slim image from Docker Hub if you do not have it, creates a container, runs the command and removes the container afterwards because of --rm.

Layers

Images are built in layers. Each instruction in a Dockerfile that changes the file system adds a layer. Layers are cached and shared: ten images based on the same Python base image store that base only once. Understanding layers is the key to fast builds, which we cover in section two.

On macOS and Windows

Containers need a Linux kernel. Docker Desktop runs a small Linux virtual machine in the background and forwards your commands to it. This is mostly invisible, but it explains why file sharing between your Mac and a container can be slower than on Linux.

What containers do not do

Containers are not a security boundary as strong as a virtual machine, they do not make an application scalable by themselves, and they do not store data safely unless you use volumes. Keep these limits in mind; each has a lesson later in the course.