What Docker Containers Actually Isolate

"A container is like a lightweight virtual machine" is the most common explanation of Docker — and it's close enough to be useful, but wrong in a way that matters once you're debugging one.

A VM virtualizes hardware; a container doesn't

A virtual machine runs its own full operating system kernel on top of virtualized hardware. A Docker container runs as an ordinary process on the host machine, using the host's own Linux kernel — there's no second OS booting underneath it. That's why containers start in milliseconds and VMs take seconds to minutes.

So what is actually isolated?

Docker uses Linux kernel features — namespaces and cgroups — to give each container its own view of specific things, while still sharing the underlying kernel:

• Filesystem — its own root filesystem, built from the image layers.
• Process table — it can't see or signal processes outside itself.
• Network — its own network interface and IP, unless configured otherwise.
• Resources — cgroups can cap how much CPU and memory it's allowed to use.

Why this matters in practice

Because containers share the host kernel, a container built for Linux can't run natively on a Windows or Mac kernel — which is why Docker Desktop on those platforms quietly runs a small Linux VM in the background to host the containers. It also means a kernel-level vulnerability can, in principle, affect every container on that host — isolation is strong, but it isn't the same hard boundary a full VM provides.