Containers are also a virtualization technology; however, they do not virtualize a physical server. Instead, a container is an operating system-level virtualization. What this means is that containers share the operating system kernel, provided by the host, among themselves along with the host. Multiple containers running on a host (physical or virtual) share the host operating system kernel. Containers ensure that they reuse the host kernel instead of each having a dedicated kernel to themselves.
Containers are also completely isolated from the host and other containers, such as a virtual machine. Containers use Windows storage filter drivers and session isolation to isolate operating system services such as the filesystem, registry, processes, and networks. Each container gets its own copy of operating system resources.
The container has the perception that it has a completely new and untouched operating system and resources. This arrangement provides lots of benefits, as follows:
- Containers are fast to provision. They do not need to provide the operating system and its kernel services. They are available from the host operating system.
- Containers are lightweight and require fewer computing resources than virtual machines. The operating system resource overhead is no longer required in containers.
- Containers are much smaller than virtual machines.
- Containers help solve problems related to managing multiple application dependencies in an intuitive, automated, and simple manner.
- Containers provide infrastructure to define all application dependencies in a single place.
Containers are an inherent part and feature of Windows Server 2016 and Windows 10; however, they are managed and accessed using a Docker client and a Docker daemon. Containers can be created on Azure with Windows Server 2016 SKU as an image. Each container has a single main process that must be running for the container to exist. A container will stop when this process ends. Also, a container can either run in interactive mode or in a detached mode like a service.
The preceding diagram shows all the technical layers that enable containers. The bottom-most layer provides the core infrastructure in terms of network, storage, load balancers, and network cards. At the top of the infrastructure is the compute layer, consisting of either a physical server, or both physical and virtual servers on top of a physical server. This layer contains the operating system with the ability to host containers. The operating system provides the execution driver that the layers above use to call kernel code and objects to execute containers. Microsoft has created Host Container System Shim (HCSShim) for managing and creating containers and uses Windows storage filter drivers for image and file management.
The container environment isolation ability is provided to the Windows session. Windows Server 2016 and Nano Server provide the operating system, enable the container features, and execute the user-level Docker client and Docker engine. The Docker engine uses the services of HCSShim, storage filter drivers, and sessions to spawn multiple containers on the server, each containing a service, application, or database.