What is a Container?

Container (generic context)

In a generic context within computer science, container can refer to any construct that holds data in memory. Examples are endless, but some include:

• An array or list in any language.
• A struct in any language that supports them.
• An object created from a class in any language that supports classes.

Container (common context)

More commonly, container refers to a containerized operating system environment. Most commonly, the engine used to drive this containerization is Docker. A container is like a separate instance of your operating system that is isolated from the base operating system (as well as other containers). It's important to note that Docker containers are not 100% isolated from each other. They're technically referred to as lightweight isolation environments (on Linux systems, Docker utilizes the Namespace feature of the Linux kernel). Processes running in one container are visible to other containers (although likely with a different Process ID). Files saved in one container are not visible to another container, however, it is possible to mount a storage volume to multiple Docker containers to share files between them. This lightweight level of isolation provides good performance and has many use cases:

• Cleaner way to develop multiple applications at once on a developer's own machine.
• Portability of an application developed within a container. This portability makes it easy to move the application from development to production. It also reduces the risk of compatibility issues.
• Scalability is achieved in containerization through the fact that the container is not a virtual machine (completely isolated from its host). It's a lightweight isolation environment, and so although limits can be applied on its resources, those limits can also be adjusted during runtime.
• Faster deployments are also achieved through the fact that the container shares the host machine's kernel, so fewer components need to be started in order to start the container (compared to a virtual machine).
• Improved Security of containerized applications is achieved through isolation. For example, if a container is compromised through an exposed network, gaining access to the host from within the container is another hurdle for the attacker.
• Improved resource utilization compared with entire virtual machines because of the shared kernel.

Following the release of Docker, the Open Container Initiative was released so that an image which adhered to the OCI standard could be run on any container runtime that supported the standard. Other container runtimes include:

• Kata: These containers use virtual machines for improved isolation, rather than Docker's use of Linux namespacing.
• gVisor: Released by Google, these containers are run in a sandbox (halfway between Linux namespacing and full-on machine virtualization).
• Firecracker: Released by AWS, this container system powers AWS Lambda and AWS Fargate. It's specifically designed for the serverless use-case.

Docker Components

Below are the most important components of Docker that should be noted by a novice who asks 'what is a container':

• The Image contains instructions for creating a container. An image is typically tailored to a single platform (CPU architecture), but multi-platform images can also be built. Images include system configurations, system libraries, and other dependencies needed to run an application, given the application's requirements. Images can be layered on top of one another via Dockerfiles.
• The Container is an instance of an image where one may be building a specific application with specific system configurations and filesystem structure.
• The Daemon is a background process that manages Docker objects, such as images, containers, networks, and volumes.

Other important components:

• Storage volumes were mentioned earlier in this post.
• Docker's networking plays a big role in its magic of routing traffic from within a container to a host's external port and vice versa.

For a look under the hood of Docker, see this CodeMentor blog post.

Container vs Virtual Machine

Virtual machines have been mentioned throughout this post. They are often compared with containers, and in some use cases, virtual machines are required to run a container. Atlassian has already explained the difference between a virtual machine and a container. To sum it up, virtual machines require a Hypervisor to run. They are responsible for dividing hardware resources such as memory, CPU, power, and network bandwidth. Containers, on the other hand, share these resources. A container's resources can be limited, but those limits can be adjusted at runtime (after starting). Most virtual machines do not allow changing its allocated resources after starting. Virtual machines offer a much deeper level of isolation, making them more secure, but also slower to start.

Nowadays, all Docker installations require virtualization, as noted on the requirements of the installation notes (even Linux's Docker installation). However, not all container instantiations of Docker images require virtualization. This Stackoverflow post explains the situation regarding Docker's ability to run natively on a platform. To sum it up, Docker containers offer various levels of isolation with the docker run command. Some of these isolation levels provide machine virtualization, so it's listed as an installation requirement for all operating systems.

More information on Docker's use of the Hypervisor with MacOS:

• How does Docker run a Linux Kernel under MacOS host
• Docker UniKernels

Relation to Kubernetes

Kubernetes is a container orchestration system that automates the deployment, scaling, and management of containerized applications. Kubernetes provides several features such as automatic scaling, self-healing, and rolling updates that can be applied to Docker containers, making it easier for developers to manage their applications in a production environment. Docker provides the packaging and runtime for containers, while Kubernetes provides the orchestration and management of those containers in an environment.

Use in Cloud Platforms like AWS

The portability of containers is utilized in Cloud Platform services, such as AWS's Elastic Container Service, where containers can be launched and scaled with greater ease and performance, with features such as:

• Automatic scaling of container resources.
• Built-in load balancing.
• High-availability where failed containers are automatically replaced.

Larger Cloud Platforms like AWS also tend to offer container registries, like Elastic Container Registry. They also tend to offer managed Kubernetes services, like AWS's Elastic Kubernetes Service.

Updated: 2024-01-31