mediumConceptEntryMidSenior
What is a container image, and why is a container not a virtual machine?
A container image is layered filesystem content plus runtime config, while a container is a host process isolated by namespaces and cgroups. A virtual machine boots its own guest kernel, so the isolation boundary and startup model are different.
5 min readUpdated 2026-08-15
Answer
Short answer
A container image is a set of read-only layers and config used to start a process. A container is not a virtual machine because it shares the host kernel and gets isolation from namespaces and cgroups instead of booting a separate guest operating system.
Was this answer helpful?
Likely follow-ups
- You add a dependency and every subsequent build reinstalls everything. What is wrong with the Dockerfile ordering?
- How does a multi-stage build reduce the final image, and what exactly is left behind?
- Why can a Linux container not run on a Windows kernel, and what is Docker Desktop doing about it?
- Which is the stronger boundary for running untrusted code, and what would you use instead of a plain container?
Related questions
- What happens when a container hits its CPU limit, and what happens when it hits its memory limit?mediumAlso on containers and cgroups5 min
- Your .NET service keeps getting OOM-killed in its container while the GC reports a small heap. Where has the memory gone?hardAlso on containers6 min
- Two replicas of the same deployment are running different code, and both were started from the same image tag. How did that happen and what do you change?hardAlso on containers6 min
- A flex item with a long URL in it pushes past its container instead of shrinking. Why does flex-shrink not save you?mediumSame kind of round: concept4 min