[fChk]

To answer the question asked in this post of mine, ie the 'where Docker containers fit in the big Container-based Virtualization picture, an overview of the whole field is warranted and -as usual with me- this is done in its historical context. So, this thread is about setting the broad historical context of Containers technologies, highlighting the milestones events occurring in the path towards the kick-starting of the LXC project in 2008, which led to the Docker project, open-sourced in 2013, which was foundational in setting the industry standard for 'containerized application' and all the tooling that goes with it.
-------------------------------------

Container-based virtualization (ie OS virtualization), as contrasted to the hypervisor-based or VM-based virtualization (ie machine/hardware virtualization), has been a hot subject in the IT world for more than a decade now.

The following table (*) gives a direct comparison between VMs and containers:

Code: (Select All)

Virtual Machines (VMs)                   | Containers
--------------------------------------------------------------------------------------
Represents hardware-level virtualization     Represents OS-level virtualization
Heavyweight                                  Lightweight
Slow provisioning                            Real-time provisioning and scalability
Limited performance                          Native performance
Fully isolated thus more secure              Process-level isolation thus less secure

(*)- The code tag is used here to maintain the table formatting.

1- Containerization technologies
Containers are an old concept. Below is a summary list for the milestones and evolution of the concept which culminated in the split between system containers and the more popular application containers championed by Docker Inc. since 2013 and their standardization in the OCI specification in 2015:

• For decades, UNIX systems have had the chroot command that provides a simple form of filesystem isolation.
  
• The FreeBSD jail: since 1998, FreeBSD has had the jail utility, which extended chroot sandboxing to processes.
  
• Solaris Zones offered a complete containerization technology around 2001 but was limited to the Solaris OS for the x86 and SPARC systems.
  
• In 2001, Parrallels Inc released the commercial Virtuozzo container technology for Linux and later open sourced the core technology as OpenVZ in 2005.
  
• In 2006, Google Inc. started the development of CGroups for the Linux kernel and began switching its infrastructure to containers.
  
• In 2007, Linux kernel 2.6.24 released with support for cgroups v1 (Control groups.)
  
• In 2008, The Linux Containers (LXC) project started and brought together CGroups, kernel namespaces, and chroot technology (among others) to provide a complete containerization solution in Linux systems.
  > LXC is a project centered around a C-based library, liblxc which allows for the creation of containers of any type from userspace. It also provides a set of tools (lxc-*) that allows interacting with that C library and offers a raw low level user interface. This is why it it remained only useful for system engineers with the required know-how.
  
• In late 2014, Canonical launched LXD project which is a REST API written in Go around LXC and creates a system daemon that apps can access locally using a Unix socket, or over the network via HTTPS. The goal being the democratization of system containers by lowering the entry-level for non-specialists.
  
• In 2016, Canonical released LXD, which is its own container manager that focuses on system containers and which uses liblxc through go-lxc.
  

Among the Containerization technologies listed above, LXC (for LinuX Containers) is the one that interests us in this thread as it's the original implementation from which all kinds of other Linux containers implementations derive, including Docker containers. It indeed represents an operating-system-level virtualization environment (VE) for running multiple isolated Linux systems (containers) on a single Linux machine. These Linux containers are basically made of three Linux kernel primitives:

• Linux namespaces which defines what a process can see
  
• CGroups which set the resources a process can use
  
• A rootfs
  

More on this later when we'll be discussing the role of the so-called 'low-level container runtimes', like lxc, runc, crun etc..

Another interesting observation that can be made from the Containerization technologies listed above (ie Solaris Zones, Virtuozzo’s OpenVZ, FreeBSD jails and LXD/LXC containers) is that they are all designed primarily as a way to containerize a complete OS rather than just a single app, which means that they are all system containers.

Next post will be about the transition to the 'application containers' with the release of Docker as an open-source project in 2013.

2- From System Containers to Application Containers

[tbelldesignco]

This was very educational, right now I am working on learning more about Docker, simply because for my ergonomics software, I want to be able to rapid deploy it in a container that I can assign an IP address to and then route a subdomain to it. That way I can keep my thumb on the software and as I add more services (a la iCloud) it will be easier to containerize instances of the services and rapidly deploy them to my customers.