VMs vs Containers

Virtual machines run a full OS on emulated hardware. Containers share the host kernel and isolate processes with namespaces and cgroups. The tradeoff: VMs are heavier but more isolated; containers are lighter but less secure.

The idea

A hypervisor (Type 1 on bare metal, Type 2 on a host OS) emulates hardware for each VM. Each VM runs its own kernel, init system, and userland. Boot time is seconds to minutes. Disk images are gigabytes. A container shares the host kernel and runs a single process tree. Docker builds images with layers (base OS + app dependencies). Boot time is milliseconds. Images are tens to hundreds of megabytes.

VMs provide stronger isolation: a compromised guest cannot access the host kernel directly. Containers rely on kernel features (cgroups, namespaces) that have had privilege-escalation bugs. Use VMs for untrusted workloads; use containers for density and speed.

The maths

Try it

Application

Guest OS

Hypervisor

Host OS

Hardware

VMs: Each guest has its own OS. Higher isolation, bigger overhead.

Virtual Machine architecture

Interactive demonstration of systems concepts

Where I used it

Easy to get wrong

Sources

Covered in COMP90024 (2023). Hands-on practice with Docker and Ansible deployments on Melbourne Research Cloud VMs.