Containers

A container is a lightweight, standalone, and executable package of software that bundles application code, runtimes, system tools, libraries, and settings so it runs reliably across any computing environment. Unlike virtual machines, containers share the host’s operating system kernel, making them significantly more lightweight and faster to start. It let’s us run applications consistently across different computing environments.

Containerization ↗ is the process of packaging an application and the necessary resources (such as libraries and packages) required into one package named a container. this makes applications considerably portable and hassle-free to run.

Containerisation platforms remove the headache of packaging the dependencies together and “isolating” the application’s environment.
Docker is one such open source containerization platform. other examples are podman.

Namespaces#

Containerisation platforms make use of the “namespace” feature of the kernel, which is a feature used so that processes can access resources of the operating system without being able to interact with other processes.

Namespaces essentially segregate system resources such as processes, files and memory away from other namespaces.
Every process running on Linux will be assigned two things:

• A namespace
• A process identifier (PID)

Processes can only “see” other processes that are in the same namespace.

The isolation offered by namespaces adds a benefit of security because it means that if an application in the container is compromised, usually (unless they share the same namespace), other containers are unaffected.