Loading...
11.2.2Advanced Systems and RepresentationCore
Containers and Virtual Machines
Draw the layers between an application and physical hardware. Choose an isolation approach from operating-system needs, startup cost, resource use and the consequences of sharing a kernel.
What you'll be able to do
- Compare container and system-VM layer diagrams
- Explain the benefits and limits of kernel sharing
- Recommend deployment isolation for a stated scenario
1
Draw the virtual-machine boundary
A system virtual machine presents virtual hardware managed by a hypervisor. Each guest can run its own operating-system kernel, system libraries and applications. A type-1 hypervisor runs directly on hardware; a hosted type-2 arrangement runs with a host OS. Both still require real processing, memory and storage underneath their abstractions.
Separate guests can support different operating-system environments and independent configurations on one physical host. This can suit testing software across OS versions or running legacy services. Allocated memory, virtual-disk space and guest startup take resources, while contention and virtualisation overhead can affect performance. A snapshot helps capture a state but is not automatically an independent, tested backup.
2
Place containers above the shared kernel
A container packages an application and its user-space dependencies and runs it as isolated processes using a container runtime. Containers on a native container host share the host’s kernel; each does not boot a complete independent guest kernel. Isolation and resource controls separate process views and limit access when configured correctly. An image is the packaged template; a container is a running instance with its runtime state.
Kernel sharing often reduces startup and memory overhead compared with booting a full guest OS for each service. It also means kernel compatibility matters. A Linux container does not simply bring a Windows kernel inside its image. Desktop tools can use a supporting VM to supply the required kernel, and cloud containers frequently run inside VMs. These combined arrangements do not remove the distinction between the two isolation layers.
3
Evaluate the real requirements
For many small instances of the same Linux service, containers can support repeatable dependency packaging and efficient scaling. For a task requiring a different guest kernel or a whole independent OS environment, system VMs can be more appropriate. State the reason using the workload rather than claiming one technology always runs faster or is always secure.
A container shares an important trust boundary at the host kernel; excessive privileges, exposed secrets or a kernel vulnerability can undermine isolation. VMs also depend on hypervisor and guest configuration. Persistent data need an explicit storage and recovery design: deleting a replaceable application instance must not be assumed to retain every change made inside it. The exam skill is to complete a layer diagram and connect these mechanisms to a justified recommendation.
| Layer or property | System VM model | Native container model |
|---|---|---|
| Application and libraries | Inside each guest | Packaged per application/container |
| Kernel | Separate guest kernel per VM | Host kernel shared by containers |
| Management layer | Hypervisor and virtual hardware | Container runtime and OS isolation |
| Typical trade-off | Independent OS environments; larger per-guest footprint | Lighter instances; kernel compatibility and shared-kernel boundary |
4
Work through the problem
Attempt the task before opening its worked response. Record each change of state, explain the rule used, and check the result against the original requirements. Code examples labelled Python 3 use that language’s conventions; pseudocode states its own assumptions.
Example 1A laboratory must test an application on two different guest OS kernels on one physical machine. Which model directly provides this?
1A system VM can boot its own guest kernel.
2Native containers share the kernel supplied by their host.
AnswerSeparate system VMs, with enough resources and appropriate guest licences/configuration.
Example 2A team calls a container image a running VM. Correct both parts of the description.
1An image is a packaged template; a container is a runtime instance.
2A native container uses the host kernel instead of booting a separate guest kernel.
AnswerAn image can create containers; a system VM has a different operating-system boundary.
Common mistakes to avoid
Drawing a complete guest kernel inside every native container.
Place containers above a shared host kernel.
Equating dependency packaging with guaranteed security.
Evaluate privileges, kernel boundaries, secrets and configuration.
Key takeaways
- VMs virtualise machine environments with guest kernels.
- Native containers isolate applications above a shared kernel.
- Requirements and trust boundaries determine a useful recommendation.
Test yourself
Answer a few questions, then review anything you missed.
Next step
Browse practice topicsKeep practising
Start with the quiz above to check the key ideas. You can also choose another topic from the practice library.