Containers & the OS
Containers are not small virtual machines: namespaces, control groups, layered filesystems, shared host kernel, and how that differs from a hypervisor.
A container is an ordinary process (or tree of processes) whose view of the system has been narrowed by namespaces, whose resource use is capped by control groups, and whose root filesystem is a stack of layers — there is no guest kernel, which is both why containers are cheap and why their isolation is weaker than a VM’s.
Two containers on a host each have a process that believes it is PID 1 and a process tree that stops at it; the host kernel sees all of them as ordinary processes with ordinary PIDs, which is exactly why a kernel bug is a bug in every container at once.
A VM puts a whole guest kernel and virtual hardware between the workload and the host; a container puts only a narrowed view of one shared kernel — the difference decides isolation strength, startup time, density and which kernel you get, and microVMs exist because neither answer was right for running other people’s code.