Namespaces & Cgroups: What Actually Separates Containers from VMs?

The Fundamental Difference

The core distinction between Virtual Machines (VMs) and Containers comes down to one question: **Where does the hardware abstraction happen?**

- **Virtual Machines**: Virtualize physical hardware. Each VM runs a full guest operating system with its own kernel, device drivers, and memory management. - **Containers**: Virtualize the operating system. All containers share the host's Linux kernel, running isolated user-space processes.

How the Linux Kernel Powers Containers

Containers are not magical virtual computers; they are regular Linux processes constrained by two core kernel features:

1. Linux Namespaces (What a process can SEE) Namespaces provide isolation by giving processes their own private view of system resources: - **PID Namespace**: Process isolation (container PID 1 maps to host PID 4321). - **NET Namespace**: Private network interfaces, routing tables, and port bindings. - **MNT Namespace**: Private filesystem mounts and root directory (`chroot` / `pivot_root`). - **UTS Namespace**: Isolated hostname and domain name. - **IPC Namespace**: Isolated Inter-Process Communication queues. - **USER Namespace**: Allows root inside container to map to unprivileged user on host.

2. Control Groups / cgroups (What a process can USE) Cgroups restrict and measure resource consumption: - **CPU limits**: Throttles CPU shares or CFS quota. - **Memory limits**: Enforces max RAM usage and triggers OOM killer if breached. - **I/O limits**: Controls disk read/write bandwidth.

Trade-Off Summary