Is Docker with containers as an isolated application really the better alternative to virtual machines? We'd like to answer this question with a simple "yes" or "no" – and you probably already guessed it – it's not that simple.
Virtual machines (also called VMs) are virtual computers that provide the same functions as physical computers – they run applications and an operating system. However, virtual machines are computer files that run on a physical computer. They function as separate computer systems.
Containers are a simple solution for dynamically deploying and transferring applications in their respective environments, entirely without compatibility issues. Likewise, they are stateless, isolated from each other, and do not persist data if this is not desired.
The differences in the operating system
Virtual machines always run a complete operating system including the kernel. This demands more system resources, memory, and storage space. Docker, as a container type, on the other hand, only runs the necessary components of an operating system. Containers can be configured so that only those services are included in the container that is necessary for running, for example, an app. More containers than virtual machines fit on a server.
Differences in isolation & security
Should the software become infected with a virus, virtual machines provide a high level of security. They allow isolation from the host's operating system and from other virtual machines. Containers offer somewhat less security for the time being, as the applications are mostly isolated from the host and other containers in a simpler way. Security can be increased, for example, by the Linux kernel extension SE-Linux (Security-Enhanced Linux), which consists of a kernel patch and extensions for system programs and thus ensures a high degree of security.
The main differences between virtual machines and containers
The core difference lies in the level of abstraction: VMs virtualise the entire hardware stack including the OS kernel, while containers share the host OS kernel and only virtualise the user space. This makes containers significantly lighter, faster to start, and more resource-efficient – at the cost of slightly weaker isolation boundaries.
Will container-based technologies completely replace virtual machines?
The question arises: do VMs still have their raison d'être? At Supper & Supper, we use both technologies – Docker and virtual machines. Our standard use case is to launch a virtual machine in the cloud and then deploy our services in Docker containers on those machines. This hybrid approach combines the strong isolation of VMs with the deployment flexibility of containers.
The practical answer: containers excel for microservices, CI/CD pipelines, and scalable ML inference. VMs remain the better choice for strong multi-tenant isolation, legacy applications, and full OS-level control. The two technologies are complementary rather than competing.
Important Docker terminology
As mentioned earlier, here are some important terms you will encounter again and again in the field of container-based technologies.
Docker image
A Docker image is a file made up of several layers that serves to run code in a Docker container. It is a set of instructions from which Docker containers are created.
Docker container
A Docker container is a runtime instance of an image. It lets developers package applications together with all their components, such as libraries and other dependencies.
Dockerfile
This is a text document containing the necessary commands that help assemble a Docker image when executed. The image is built using a Dockerfile.
Docker Engine
This is the software that hosts the containers and is a client-server-based application. It consists of several main components:
- SERVER: The server is responsible for creating and managing Docker images, containers, networks, and volumes on the Docker server. It is referred to as the daemon process.
- REST API: The REST API defines how applications can interact with the server. It tells the server what to do.
- CLIENT: The client is a Docker command-line interface (CLI). It lets us interact with Docker using the Docker commands.
- DOCKER HUB: Docker Hub is the official online repository where you can find other available Docker images. You can find, manage, and share container images with others.
