What is the difference between a container and a virtual machine?
A virtual machine runs a full guest operating system on virtual hardware provided by a hypervisor. A container is just an isolated process that shares the host's kernel, so it starts in seconds or less, uses far less memory, and is lighter to ship, but gives weaker isolation than a VM.
Explain it simply
Think of a building. A virtual machine is like building a separate house for every family: each one gets its own foundation, plumbing, wiring and kitchen. It is very private, but expensive and slow to build. A container is like a flat in an apartment block: every family has its own locked door and its own rooms, but they all share the same foundation, water line and lift. Flats are cheaper and you can move in much faster.
The shared foundation here is the operating system kernel. A VM brings its own kernel. A container borrows the host's kernel and only packs the application plus the libraries and files it needs.
Example
| Virtual machine | Container | |
|---|---|---|
| What it contains | Full guest OS, kernel, libraries, app | App, libraries and a minimal filesystem |
| Kernel | Its own | Shared with the host |
| Typical size | Gigabytes | Megabytes to a few hundred MB |
| Start time | Tens of seconds to minutes (OS boot) | Usually under a second to a few seconds |
| Isolation | Strong, hardware-level | Process-level, depends on the kernel |
| Managed by | Hypervisor (KVM, VMware ESXi, Hyper-V) | Container runtime (containerd, runc) via Docker or Kubernetes |
| Run a different OS? | Yes, Windows VM on a Linux host is fine | No, Linux containers need a Linux kernel |
How it works
A hypervisor creates virtual CPUs, memory and disks. Each VM boots a complete operating system on that fake hardware, so each one pays the memory and CPU cost of an entire OS.
A container is a normal Linux process with two kernel features wrapped around it. Namespaces change what the process can see: its own process list, network interfaces, hostname and mount points, so it thinks it is alone on the machine. Cgroups limit what it can use: how much CPU and memory it may consume. The container's filesystem comes from an image made of read-only layers. There is no second kernel and no boot step, which is why containers start so quickly.
On a Mac or Windows laptop, Docker Desktop quietly runs a small Linux VM and your Linux containers run inside it. That is a good detail to mention because it shows you understand that containers need a Linux kernel.
Real-world use
Most companies use both together. A cloud provider gives you VMs (an EC2 instance, for example), and you run many containers on each VM through Kubernetes or a similar tool. The VM gives strong isolation between customers; containers give fast, dense packing of your own services. A team running a food delivery app might pack thirty small services onto a handful of VMs instead of buying thirty VMs.
Common mistakes
- Calling a container a "lightweight VM". It is not a machine at all; it is an isolated process.
- Saying containers are as secure as VMs. A kernel bug can affect every container on the host, so multi-tenant platforms add VMs or sandboxes underneath.
- Thinking containers replace VMs entirely. In the cloud they almost always run on top of VMs.
- Believing a Windows app can run in a Linux container. The kernel must match.
What to say in the interview
"A VM virtualises hardware. A hypervisor gives each VM virtual CPU, memory and disk, and each VM boots its own full operating system, so it is heavy but strongly isolated. A container virtualises at the OS level. It is a process that shares the host kernel and is isolated using namespaces for visibility and cgroups for resource limits. So containers are smaller, start in seconds and pack densely, while VMs give stronger isolation and can run a different OS. In practice we run containers on VMs to get both."
Follow-up questions
- What are namespaces and cgroups?
- Why can a Linux container run on a Mac with Docker Desktop?
- When would you still choose a VM over a container?
- What is a microVM, such as Firecracker?
Go deeper
Read these once the basics above feel easy.
Linux namespaces include PID, network, mount, UTS (hostname), IPC and user namespaces. Cgroups v2 controls CPU, memory, I/O and process counts. A container that exceeds its memory limit is killed by the kernel's OOM killer, which you see as exit code 137 in Docker.
Sandboxed runtimes close the gap between the two models. gVisor intercepts system calls in a user-space kernel, and Kata Containers and Firecracker run each container or function inside a tiny VM that boots in a fraction of a second. AWS Lambda and Fargate use Firecracker so they can give VM-level isolation with container-like speed.