Programmer Humor

I can't remember exactly what all the pieces are. However, I believe its a combination of

• cgroups: process isolation which is why you can see docker processes in ps/top/etc but you can't for vms. I believe this is also what gets you the ability to run cross distro images since the isolation ensures the correct shared objects are loaded
• network namespaces: how they handle generating the isolated network stack per process
• some additional mount magic that I don't know what its called.

My understanding is that all of the neat properties of docker are actuall part of the kernel, docker (and podman and other container runtimes) are mostly just packing them together to achieve the desired properties of "containers".

It makes it very easy to define the environment and conditions in which a process is run, and completely isolate it from the rest of the system. The environment includes all the other software installed in said isolated environment. Since you have complete isolation you can install all the software that comes with what we think if as a linux “distribution”, which means you can do something like run a docker container that is “ubuntu” or “debian” on a “CentOS” or whatever distribution.

When you start a Dockerfile with the statement FROM ubuntu:version_tag you are more or less saying “I want to run a process in an environment that includes all of the3 software that would ship with this specific version of ubuntu”

A linux distro == Kernel + “user land” (maybe not the correct terminology). A docker container is the “user land” or “distro” + whatever you’re wanting to run, but the Kernel is the host system.

I found this pretty helpful in explaining it: https://earthly.dev/blog/chroot/

I’ll also say that folks say pretty nonchalantly deride Docker and other tools as if it’s just “easy” to set these things up with “just linux” and Docker is something akin to syntax sugar. I suspect many of these folks don’t make software for a living, or at least don’t work at significant scale. It might be easy to create an isolated process, it’s absurd to say that Docker (or Podman, etc..) doesn’t add value. The reproducibility, layering, builders, orchestration, repos, etc.. are all build on top of the features that allow isolation. None of that stuff existed before docker/other container build/deploy tools.

Note: I’m not a Linux SME, but I am a software dev who uses Docker every day — I am likely oversimplifying some things here, but this is a better and more accurate oversimplification than “docker is like a VM”, which is a helpful heuristic when you first learn it, but ultimately wrong