What is a container, and how is it different from a virtual machine?
What they are really testing: Whether you understand what is actually being isolated. They want the kernel-sharing insight, because it explains every practical difference: startup time, image size, density, and the security caveat.
A real interview question
What is a container, and how is it different from a virtual machine?
What most people say
drag me
“A container is a lightweight VM.”
It is the single most common wrong answer. It gives no mechanism, so the candidate cannot explain why containers start faster or where the security boundary is weaker, which is exactly what the follow-up will ask.
The follow-ups they ask next
So is a container a security boundary or not?
It is a real but weaker one. A kernel exploit escapes it in a way it would not escape a hypervisor. Mitigate with non-root users, dropped capabilities, read-only filesystems, seccomp, and VM-level isolation for hostile workloads.
Why does the same image behave identically on your laptop and in production?
The image bundles the userland: libraries, binaries, dependencies. What it does not bundle is the kernel, which is why a kernel-version-sensitive workload can still differ.
What the interviewer is listening for
- Names namespaces and cgroups
- Derives speed and size from kernel sharing
- States the isolation trade-off without being asked
What sinks the answer
- Says "lightweight VM" and stops
- Cannot name any isolation mechanism
- Claims containers are as isolated as VMs
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“A container is [an isolated process sharing the host kernel], isolated by [namespaces for visibility and cgroups for resources]. A VM [ships its own kernel on a hypervisor]. So containers are [smaller and start far faster] but have [weaker isolation because the kernel is shared].”
Keep going with containers
Junior
Our Docker image is 1.2 GB and takes 8 minutes to build. How would you make it smaller and faster?
Foundation
What is the difference between continuous integration, continuous delivery, and continuous deployment?
Foundation
What does DevOps actually mean, and what problem was it invented to solve?
Foundation
What is infrastructure as code, and why is it better than clicking in a console?
Foundation
Why should the same build artifact be promoted through environments instead of rebuilding for each one?
Foundation
Where should configuration like database URLs and API keys live, and why not in the repository?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free