Containers have become the de facto way of running applications on the server, and while Docker is the most well-known way of doing this, there are other alternatives e.g. podman, LXC, containerd.

However, they are all built on the same foundational technologies provided by Linux, and this series of tutorials will start off by taking a look at these:

• In which we look at namespaces
• In which we look at control groups
• In which we look at overlay file systems

We'll then take a look at how these things are used, in practice:

• In which we look at Docker images and containers
• In which we look at the Open Container Initiative

Finally, we put all these pieces together and build an OCI-compliant image, manually and from scratch, and then run it:

• In which we build an OCI image and container, the hard way

The difference between images, containers and virtual machines

Before we start, it's worth clarifying what these things are, and the differences between them.

A single physical computer can be partitioned into several smaller "virtual machines". These operate as smaller, independent computers, with their own operating system, and can be rebooted or powered on and off individually, as if they were actually separate computers themselves. These don't have anything to do with the subject of this tutorial series - images and containers - so we won't be talking about them at all.

A container is one or more processes that run on the host computer, but are kept separate from everything else through the use of namespaces and control groups. Other than this, they are just normal processes running on the host, same as any other process.

An image is a set of files, and a bunch of settings (e.g. environment variables) that will be used to run a container. It can contain an entire operating system, but it doesn't have to^[1]For example, Docker's hello-world image consists of a single file, a small program that prints out the "hello" message we all know and love.. In other words, an image is a static thing, a template for creating containers, while a container is a dynamic runtime thing, consisting of one or more running processes.