Containers
Packages an application with what it needs and runs it on a shared host.
What It Is
A container packages an application with what it needs to run, such as its runtime, libraries and settings, into an image that starts the same way on any host. Docker builds and runs containers on one machine. Kubernetes runs them across many, restarting and moving them as needed.
A container is not a virtual machine. A virtual machine has its own operating system, kernel included, on virtual hardware that a hypervisor provides. The kernel is the core of the operating system. Containers on one host all share that host's kernel, which keeps them apart. That makes them light and quick to start, but the wall between them is thinner.
This layer is optional. The same app can run in a container or be installed straight on a server, so a flaw here reaches only what actually runs in the containers.
- App
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
On This Layer
These are the technologies on the Containers layer that this topic covers. Open one to see what it runs on, how to spot it and what a flaw in it reaches.
How Far a Flaw Reaches
A flaw in the container platform reaches every container it runs. A container escape, through the container runtime or the shared kernel, reaches the host and every other container on it. A flaw in the Kubernetes control plane, the part that decides what runs where, can hand over the whole cluster.