Container

A container is an execution instance created by an image; it can be started, stopped, and deleted. Each container is isolated from the others.

A container is not a lightweight virtual machine, and it is not “a simplified Linux” — there is no separate OS inside it. It is an ordinary Linux process whose view is limited by namespaces and whose resources are capped by cgroups, running on the host’s kernel. The /bin, /etc, /usr you see inside are just files, shipped by the Image. → 容器是被 namespace 與 cgroups 關起來的普通行程

An image is read-only; a container adds one writable layer on top of the image’s read-only layers. That writable layer dies with the container — see 容器可拋棄，資料要靠 Volume 留在容器外.

Direction matters: a container is an image that has been started, not “an image running on a container”. docker run <image> takes an image and produces a container.

Ref：

https://philipzheng.gitbook.io/docker_practice/basic_concept/container