Virtualization Guide
- About This Manual
- I Introduction
- II Managing Virtual Machines with
libvirt - III Common Tasks
- IV Managing Virtual Machines with Xen
- 18 Setting Up a Virtual Machine Host
- 19 Virtual Networking
- 20 Managing a Virtualization Environment
- 21 Block Devices in Xen
- 22 Virtualization: Configuration Options and Settings
- 23 Administration Tasks
- 24 XenStore: Configuration Database Shared between Domains
- 25 Xen as a High-Availability Virtualization Host
- V Managing Virtual Machines with QEMU
- VI Managing Virtual Machines with LXC
- Glossary
- A Virtual Machine Drivers
- B Appendix
- C XM, XL Toolstacks and Libvirt framework
- D Documentation Updates
- E GNU Licenses
4 Introduction to Linux Containers
Linux container is a lightweight virtualization method to run multiple virtual units (containers, similar to the chroot environment) simultaneously on a single host. Containers are isolated with kernel Control Groups (cgroups) and kernel Namespaces.
Container provides an operating system level virtualization where the kernel controls the isolated containers. With other full virtualization solutions like Xen or KVM the processor simulates a complete hardware environment and controls its Virtual Machines.
4.1 Overview #
Conceptually, container can be seen as an improved chroot technique. The difference is that a chroot environment separates only the file system, whereas container goes further and provides resource management and control via cgroups.
Benefits of container #
Isolating applications and operating systems through containers.
Providing nearly native performance as container manages allocation of resources in real-time.
Controlling network interfaces and applying resources inside containers through cgroups.
Limitations of container #
All containers run inside the host system's kernel and not with a different kernel.
Only allows Linux “guest” operating systems.
Security depends on the host system. Container is not secure. If you need a secure system, you can confine it using an AppArmor or SELinux profile .