wunder beta📘 How is a container not a VM?
An application depends not just on its own code but on a large hidden environment: shared libraries, language runtimes, environment
What you’ll learn
- Why Containers Exist: The Isolation ProblemExplain the deployment and isolation problems that containers solve and how they differ from virtual machines.Software that runs on one machine often fails on another because of differences in libraries, configuration, and OS state—the "works on my machine" problem. Containers package an application together with its dependencies into a portable unit that shares the host kernel, giving process- and filesystem-level isolation with far less overhead than a full virtual machine. Understanding the VM-versus-container trade-off is the foundation for every decision later in this course.
- Under the Hood: Namespaces, cgroups, and ImagesDescribe the Linux kernel mechanisms—namespaces and cgroups—and the layered image format that make containers possible.Containers are not a single kernel feature but a combination of existing Linux primitives: namespaces provide isolation of what a process can see, and control groups (cgroups) limit how much it can use. Images are built from stacked, content-addressed read-only layers that are cached and shared to save space and build time. Knowing these mechanisms demystifies containers and explains both their efficiency and their security limits.
- Case Study: Containerizing a Web ServiceTrace, through a realistic case study, how a team containerizes a web application with a Dockerfile and a well-formed image.This lesson follows a hypothetical engineering team moving a small web service from manual server setup to a container image defined by a Dockerfile. We see how each instruction maps to an image layer, why multi-stage builds and small base images matter, and how a process inside a container should behave (logging to stdout, running as a single foreground process). The case study turns the earlier mechanisms into concrete authoring decisions.
- Container Networking, Storage, and SecurityExplain how containers communicate, how they persist data, and the principal security considerations for running them.Because containers are isolated by default, they need explicit mechanisms to talk to one another and to the outside world, and to keep data that must outlive a container. Networking ties containers together through virtual networks and published ports; volumes provide durable storage separate from the container lifecycle; and security rests on minimizing privileges, trusting image provenance, and remembering that a shared kernel is a shared risk. These operational concerns separate a demo container from a production-ready one.
- Orchestration: From One Host to ManyExplain why container orchestration is needed at scale and describe the core concepts of declarative scheduling and self-healing.Running a few containers by hand is simple, but production needs hundreds across many hosts, with health checks, restarts, scaling, rolling updates, and networking handled automatically. Orchestrators like Kubernetes solve this by letting you declare a desired state and continuously reconciling the actual state toward it. Understanding the declarative, control-loop model—and core abstractions such as scheduling, services, and self-healing—is essential for operating containers in the real world.
- Capstone: Build and Run Your Own Containerized ServiceGuide the learner to build a working multi-container artifact and a passing simulation by applying the course's concepts end to end.In this capstone you apply everything: you author a Dockerfile for a small web service, keep state in a volume, connect a second container over a defined network, and declare the whole stack in a Compose file. The deliverable is a reproducible, runnable mini-artifact plus a written rationale that maps each choice back to a course concept. Your simulation score reflects how well your artifact embodies reproducibility, least privilege, durable state, and correct multi-container wiring.
Questions this course answers
What is the most fundamental difference between a container and a virtual machine?
The defining distinction is the kernel boundary: containers share the host kernel and isolate at the process level, whereas each VM carries a full guest OS on top of a hypervisor. This is what makes containers lighter and faster but gives VMs a stronger isolation boundary.
Which statement best captures the relationship between an image and a container?
An image is the immutable, layered template (like a class), and a container is a live instance of that image (like an object). You rebuild images rather than editing running containers to make changes persist.
Why do containers typically start much faster and use less memory than virtual machines?
A container is essentially an isolated process group on the host kernel, with no guest OS to boot, so startup is on the order of milliseconds and memory overhead is minimal compared with a VM that must boot a full operating system.
What is the primary role of Linux namespaces in containers?
Namespaces isolate a process's view of global resources (PIDs, mounts, network, hostname, users, etc.). Limiting how much a container can consume is the job of cgroups, not namespaces.
A container repeatedly consumes so much memory that other containers on the host slow down. Which kernel mechanism is designed to enforce a memory cap on it?
cgroups measure and limit resource usage (CPU, memory, I/O, process count) for a group of processes, which is exactly what enforces a per-container memory cap and addresses the 'noisy neighbor' problem.
Why are identical image layers stored only once even when used by many images?
OCI image layers are identified by the cryptographic hash of their contents. Identical content produces the same digest, so the layer is stored and transferred once and reused across images, saving space and time.
Grounded in trusted sources
- Docker Docs, “What is a container?” — image vs container basics, https://docs.docker.com/get-started/
- Linux man-pages: namespaces(7) and cgroups(7) — kernel isolation primitives
- OCI Runtime Spec / Image Spec — portable container standards, https://opencontainers.org/
- Kubernetes Docs, Concepts — pods, networking, and storage overview, https://kubernetes.io/docs/concepts/
- NIST SP 800-190, Application Container Security Guide, https://csrc.nist.gov/publications/detail/sp/800-190/final
Every Wunder lesson is built from real, reputable sources — never invented.
Related courses
Wunder is a personalized learn-anything platform — tell it any topic and it builds a beautiful, fact-checked course in minutes, with narration, a knowledge check, and a college-style University track.
© 2026 Wunder Learning LLC · Terms & Privacy