### a container is a group of Linux processes

Illustration of a smiling stick figure with curly hair.

person: on a Mac, all your containers are actually running in a Linux virtual machine

panel 2

person: I started ‘top’ in a container. Here’s what that looks like in ps:

• outside the container
  $ ps aux grep top USER PID START COMMAND root 23540 20:55 top bork 23546 20:57 top
• inside the container $ ps aux | grep top USER PID START COMMAND root 25 20:55 top (root 23540 20:55 top and root 25 20:55 top are the same process!)

container processes can do anything a normal process can…

Illustration of a smiling stick figure with curly hair, and Linux, represented by its penguin mascot

person: I want my container to do X Y Z W! Linux: sure! your computer, your rules!

but usually they have restrictions

(there are drawings of locks on either side of the word “restrictions”)

Illustration of a container, represented by a box with a smiley face. Around it are arrows with the following labels: - different PID namespace - different root directory - cgroup memory limit - limited capabilities - not allowed to run some system calls

the restrictions are enforced by the Linux kernel

Linux: NO, you can’t have more memory!
person: on the next page we’ll list all the kernel features that make this work!