Before this:What is deployment?
What is a container?
Key takeaways A container packages an application with everything it needs to run — libraries, files, dependencies — and runs it isolated on a shared host kernel. Unlike a virtual machine, it doesn’t carry a whole operating system, so it’s light and fast. Containers solve “works on my machine” by shipping the whole environment, not just the code.
Unit 1 named the “works on my machine” problem. Containers are the most popular solution, and this lesson explains what they actually are.
Ship the environment, not just the code
The insight behind containers is simple: instead of shipping your program and hoping the target machine has the right libraries and settings, you ship your program together with its libraries, dependencies, and environment, bundled into one unit. That bundle — a container — runs the same on your laptop, a colleague’s machine, and a cloud server, because it brings its whole world with it.
Containers vs virtual machines
Both isolate software, but at very different weights:
| Virtual machine | Container | |
|---|---|---|
| Contains | a full guest OS | just app + its dependencies |
| Isolation | very strong (own kernel) | strong (shared kernel) |
| Size | gigabytes | megabytes |
| Start time | tens of seconds | fraction of a second |
How the isolation works
A container shares the host’s kernel but the kernel gives each container its own private view: namespaces make it see its own processes, filesystem, and network as if it were alone, and control groups (cgroups) cap how much CPU and memory it can use. So many containers safely coexist on one host without tripping over each other — lighter than VMs but still well isolated.
The vocabulary
Two words you’ll use constantly:
- An image is the packaged, on-disk bundle — the read-only template (built from a Dockerfile, shared via a registry).
- A container is a running instance of an image — like a program is a running instance of an executable.
Docker is the best-known tool for building images and running containers, and the one we’ll use. GopherTrunk ships a Dockerfile so you can run the whole scanner as a container — the subject of the next lesson.
Quick check: what's the main difference between a container and a virtual machine?
Recap
- A container bundles an app with its dependencies and runs it isolated on a shared host kernel.
- Versus a VM, it carries no guest OS — so it’s megabytes, not gigabytes, and starts almost instantly.
- The kernel isolates each container with namespaces and cgroups.
- An image is the template; a container is a running instance of it. Docker is the common tool.
Next up: writing the recipe for an image — the Dockerfile.
Frequently asked questions
What is the difference between a container and a virtual machine?
A virtual machine emulates a whole computer, running its own full operating system on top of a hypervisor — heavy but strongly isolated. A container shares the host’s operating-system kernel and just isolates the application’s files, processes, and network, making it far lighter and faster to start. For deploying most applications, containers hit the sweet spot.
Do containers include an operating system?
A container image includes the userland files an application needs — libraries, a minimal base like Debian slim, your binary — but not a kernel. It borrows the host’s kernel at runtime. That’s why images are much smaller than VM disk images and why a container starts in a fraction of a second.