Hacker News Reader

Comment by anyonecancode | Hacker News Reader

A container as just an isolated process makes enough sense to me, but where I get confused is how it allows me to use alpine or ubuntu or some other base image that differs from the actual OS I'm running on. That's what makes it feel more like a lightweight VM to me, and which doesn't seem explained by just cgroups and namespaces. Or if it is, there's something I'm still failing to understand here.

View on HN

I'd guess that the gap you're missing is that one of the namespace types containers use is a mount namespace.

During container setup, you get a new mount namespace so that any changes to mounted filesystems are only seen by processes sharing that new mount namespace. Then you mount the filesystem from the docker image, replacing the filesystems mounted in the root namespace.

I don't know if it'll help, but that process is very similar to what happens during boot, where you've initially got a root filesystem mounted from the initrd, but you replace it with the root filesystem from a disk after you've loaded the right drivers from the initrd.

Yes, that is definitely one of the gaps I had, thank you (also the other replies to my comment -- upvoted all of you). I'm generally on a Mac (which runs docker in a linux VM -- the reason why is much clearer now) and so my exposure to linux is mostly in the context of ssh-ing into a server. I think the fact that OS X is linux-like without actually being a linux distro also subtly led me astray, as I've been thinking of different distros in the same way I think of OS X as different from Windows, and not really thinking about the "userland" vs "kernel" distinction.

The layers typically go: hardware > hypervisor instance (vm) > linux+distro > process. I think it's accurate to say that containers shuffle around those last two so it looks more like: hw > vm > linux > distro+process. The complication is that the lone linux in the middle is still deployed with a distro, it's just that the distro part is abstracted away from the perspective of the container.

All of those OSes use the same linux kernel, it's only the user-space part that differs.

When you run eg. an ubuntu docker image, the entire user-space of ubuntu is running inside the container. Only the kernel is shared with the host.

Aren't centos:7 and centos:8 using different kernels?

Nope, they're just the CentOS 7 and CentOS 8 userlands running on top of the host kernel.

That's not necessarily true though; you could very well implement containers as lightweight VMs that use their own specific kernels, though the image itself doesn't contain any. Thinking in terms of containers vs VMs is missing the mark a bit.

Reply on news.ycombinator.com