Containers offer a packaging mechanism in which applications can be abstracted from the environment in which they actually run. This decoupling allows container-based applications to be deployed easily and consistently, regardless of whether the targeted environment is a private data center, a public cloud, or even a developer’s machine. Containerization provides a clean separation of concerns, as developers focus on their application logic and dependencies, while IT operations teams can focus on deployment and management without bothering with application details such as specific software versions and configurations specific to the app.

In contrast to virtual machines which emulate virtual hardwares, containers share the resources of the operating system and are much more efficient. Containerization leverages Linux kernel features to isolate processes and ensure they run independently with the expected resources. Linux kernel features leveraged include:

• Cgroups: is a feature of Linux kernel used to manage and monitor resources (CPU, memory, disk, network, etc.) for a given process and set resource limits.
• Namespaces: is a feature of Linux kernel used to partition kernel resources such that one set of processes sees one set of resources while another set of processes sees a different set of resources. Examples of such resources are process IDs, hostnames, user IDs, file names, and some names associated with network access, and interprocess communication.
• Overlay File System (Union File System): allows multiple layers of files and directories to be overlaid.