Summary
Highlights
The video starts by introducing the basic hardware, referred to as 'bare metal,' where the operating system (OS) kernel directly accesses resources like memory and CPU. It then introduces virtual machines (VMs) and containers as different ways to run applications, noting their distinctions and similarities.
On bare metal, the OS kernel has direct and highly efficient access to hardware resources. Applications communicate with the kernel, which then manages interactions with the hardware. This setup offers maximum performance and simplifies complex hardware interactions.
VMs operate using hypervisors, which emulate a physical machine, allowing a new OS to run within it. There are two types: Type 1 hypervisors (e.g., ESXI, Hyper-V) run directly on hardware, offering high performance and security. Type 2 hypervisors (e.g., VirtualBox) run as applications on an existing OS, leading to a slight performance overhead but easier installation.
Type 1 hypervisors have minimal performance loss (around 3%) for CPU-bound tasks, but I/O operations (disk, network) can experience significant slowdowns (5-70%) due to virtualized devices. VMs offer strong security isolation, making it extremely difficult for an application within a VM to break out and access other VMs or the host system.
Micro VMs are a stripped-down version of traditional VMs, removing non-essential components like BIOS, USB drivers, and full OS boot processes. They run a minimal Linux kernel and only the necessary application, offering strong isolation with ultra-lightweight images and very fast startup times. AWS uses Firecracker for services like Lambda and Fargate.
Containers, specifically 'application containers' like Docker, are based on Linux kernel features (cgroups) for isolation. They offer performance comparable to bare metal because applications directly interact with the host kernel. Unlike VMs, containers share the host's kernel, meaning all containers must use the same kernel version.
While containers offer excellent performance, their isolation is generally considered less robust than VMs, with a higher, though decreasing, risk of breakout. Containers are very lightweight, with small image sizes and reduced RAM consumption, allowing many more containers to run on a single physical machine compared to VMs.
System containers (e.g., LXC, LXD) leverage kernel-level containerization but run a full OS inside the container, including init systems like System D. This provides a more traditional OS environment, offering better compatibility for applications not designed for bare containerization, while retaining many of the performance benefits of containers.
In summary, the choice between VMs (full or micro) and containers (system or application) depends on specific needs. VMs offer stronger isolation and hardware emulation, while containers provide superior performance, lighter footprints, and faster startup times by sharing the host kernel. Micro VMs and system containers combine aspects of both for specialized use cases.