Linux · Systems fluency
How do containers work on Linux?
Short answer
Containers are isolated Linux processes built from namespaces for visibility and cgroups for resource control. They share the host kernel, so kernel isolation and host configuration matter more than with virtual machines.
Namespaces give a process its own view of PIDs, mounts, networking, users, hostnames, and inter-process communication. cgroups limit and account for CPU, memory, and I/O. An image is a packaged filesystem plus metadata, not a running virtual machine.
docker run --rm -it --cpus 1 --memory 512m alpine sh
docker inspect --format '{{.State.Pid}}' mycontainer
nsenter -t 12345 -n ss -tulpnSecurity boundaries
- Containers share the host kernel, so a kernel exploit can cross boundaries
- Privileged containers and host mounts weaken isolation dramatically
- Capabilities, seccomp, and mandatory access control reduce available actions
- Rootless containers map container root to an unprivileged host user
- Image layers are immutable, but writable layers and volumes persist state
Debug from the host when the container lacks tools: inspect the namespace, cgroup limits, and logs. A container that is OOM-killed or CPU-throttled needs its limits and actual usage examined, not just an application restart.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between a container and a virtual machine?
- 2What do namespaces and cgroups each provide?
- 3Why is a privileged container dangerous?
- 4How would you debug a container that has no shell or tools?
Say it in the interview
Containers are isolated processes. Namespaces control what the process can see, and cgroups control how much CPU and memory it can use. They share the host kernel, so kernel patching and host security still matter. I avoid privileged containers and broad host mounts, and I inspect namespace and cgroup state when debugging.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Linux mock interview and get scored feedback on depth, clarity and confidence.