Docker · Containers in practice
How do containers compare to virtual machines?
Short answer
A VM runs a full guest OS on virtualised hardware, while a container is an isolated process sharing the host kernel. Containers start faster and pack denser; VMs give stronger isolation.
A hypervisor gives each VM its own virtual hardware and kernel. A container runtime uses Linux namespaces for isolation and cgroups for resource limits, but every container on a host uses the same kernel.
- Startup: containers in milliseconds to seconds, VMs in tens of seconds
- Density: many containers per host, fewer VMs because each carries an OS
- Isolation: VMs have a hardware boundary, containers have a kernel boundary
- Image size: container images are megabytes, VM images are gigabytes
- Kernel choice: a VM can run any kernel, a container cannot
Choosing between them
Use containers for stateless services, CI jobs and anything that benefits from fast scaling and a small artifact. Use VMs when you need a different kernel, strong tenant isolation, or to run software that assumes full control of the machine. Many production systems combine both: containers scheduled onto VMs.
Kernel-sharing also means a kernel vulnerability can affect every container on the host. That is why hardened runtimes, user namespaces and sandboxed runtimes exist for multi-tenant workloads.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why do containers start faster than virtual machines?
- 2Can a container run a different kernel from its host?
- 3What isolation mechanisms does a container rely on?
- 4When is a VM still the better choice?
Say it in the interview
A VM virtualises hardware and runs a complete guest operating system, while a container is a process isolated with namespaces and limited with cgroups on the host kernel. That is why containers start in milliseconds and pack much more densely. The trade-off is a weaker isolation boundary, so for untrusted multi-tenant workloads I would use VMs or a sandboxed runtime rather than plain containers.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Docker mock interview and get scored feedback on depth, clarity and confidence.