Lightweight Isolation Without a VM
A container engine is required to run a containerized application package (or, image) on a machine. When a container engine runs an application image, it limits what the running app can see and do on the machine. A running containerized application behaveslike an app running in a simple virtual machine, but it is not – the isolation is applied by the container engine process but enforced directly by the host kernel. Also, unlike a heavyweight VM, a container can start and stop very quickly within in seconds.