What Is a Docker Container?
Learn what a Docker container is, how it differs from a VM and an image, why it starts fast, and how kernel namespaces and cgroups provide isolation.
Expected Interview Answer
A Docker container is a lightweight, isolated, runnable instance of an image that packages an application together with everything it needs — code, runtime, libraries, and settings — so it behaves the same way on any host running Docker.
Containers share the host machine's kernel instead of virtualizing an entire operating system, which makes them start in milliseconds and use far less memory and disk than a virtual machine. Each container gets its own isolated filesystem, process tree, and network namespace, so it cannot see or interfere with other containers by default. Because the image defines the exact environment, a container behaves identically on a laptop, a CI runner, or a production server, which eliminates the classic 'it works on my machine' problem.
- Fast startup compared to full virtual machines
- Consistent behavior across dev, test, and production
- Efficient use of CPU, memory, and disk
- Process and filesystem isolation between apps
- Easy to version, ship, and roll back
AI Mentor Explanation
A container is like a player stepping onto the pitch fully kitted with pads, gloves, and a bat already assigned, so nothing needs arranging on the spot. A substitute fielder can be sent in without disrupting the rest of the eleven, just as a container starts and stops without touching any other player. The pitch, or host, stays the same while different players take the field independently.
Step-by-Step Explanation
Step 1
Start from an image
Docker reads the image's layered filesystem and metadata to know exactly what the container should contain.
Step 2
Create isolated namespaces
The Linux kernel sets up separate process, network, and mount namespaces so the container cannot see the host or other containers.
Step 3
Apply resource limits
Cgroups cap how much CPU, memory, and I/O the container may use, protecting the host and its neighbors.
Step 4
Run the entrypoint process
Docker launches the image's configured command as PID 1 inside the container's own process tree.
Step 5
Tear down on stop
When the process exits or is stopped, the container's writable layer and namespaces are cleaned up or preserved depending on flags used.
What Interviewer Expects
- Distinguishes a container (running instance) from an image (the blueprint)
- Explains that containers share the host kernel rather than virtualizing hardware
- Mentions namespaces and cgroups as the isolation mechanism
- Can compare containers to virtual machines on startup time and overhead
- Understands that a container's writable layer is ephemeral by default
Common Mistakes
- Calling a container a lightweight virtual machine with its own kernel
- Confusing 'image' and 'container' as the same thing
- Assuming container data always persists after the container is removed
- Believing containers provide the same security boundary as a full VM
Best Answer (HR Friendly)
“A Docker container is a self-contained package that runs an application with everything it needs already included, so it works the same way on any computer. It starts up quickly and uses fewer resources than a full virtual machine because it shares the underlying operating system instead of duplicating it.”
Code Example
# Run a container from the nginx image, mapping port 8080
docker run -d --name web -p 8080:80 nginx:latest
# List running containers
docker ps
# Inspect isolation: this only sees the container's own processes
docker exec web ps aux
# Stop and remove it
docker stop web && docker rm webFollow-up Questions
- What is the difference between a Docker image and a Docker container?
- How does a container differ from a virtual machine?
- What Linux kernel features make container isolation possible?
- What happens to data written inside a container when it is removed?
- How do you limit CPU and memory usage for a container?
MCQ Practice
1. What is a Docker container?
A container is a runnable instance of an image, isolated from the host and other containers using kernel namespaces and cgroups.
2. Why do containers start faster than virtual machines?
Containers share the host's kernel, so there is no separate OS boot process, unlike a VM which boots a full guest operating system.
3. What happens to a container's writable layer by default when the container is removed?
Unless a volume or bind mount is used, the container's writable layer is deleted when the container is removed, so changes are not persisted.
Flash Cards
What is a Docker container? — A running, isolated instance of an image that packages an app with its dependencies.
Do containers virtualize hardware like a VM? — No — they share the host kernel and are isolated using namespaces and cgroups.
Is container data persistent by default? — No — the writable layer is ephemeral unless a volume or bind mount is used.
Image vs container: what's the difference? — An image is the static blueprint; a container is a running instance created from it.