Bare-metal hypervisor
Runs directly on hardware and manages guest VMs. Data centres favour this design for control, predictable overhead and strong operational tooling.
PART 4 • SYSTEMS & CAREER
Isolate Workloads without Wasting the Machine
Understand how hypervisors virtualize hardware and how containers isolate processes while sharing one kernel. Compare performance, compatibility, density and security boundaries instead of treating either model as universally better.
BY THE END, YOU CAN
Defend an isolation choice
- Explain Type 1 and Type 2 hypervisors.
- Trace privileged guest operations.
- Connect namespaces and cgroups to containers.
- Interpret images and writable layers.
- Choose a suitable boundary for a workload.
A Virtual Machine Receives a Hardware-Like Interface
Hosted hypervisor
Runs above a host OS. It is convenient for desktop labs, but guest I/O passes through additional host layers.
Complete operating system
Each VM owns a guest kernel, virtual CPUs, virtual memory and virtual devices. Different OS families can share one physical server.
| Mechanism | What is virtualized? | Key OS idea | Main cost |
|---|---|---|---|
| Trap and emulate | Privileged operations | Hypervisor handles sensitive instruction | Transitions |
| Hardware assist | CPU execution modes | Guest runs directly until a controlled exit | VM exits |
| Nested paging | Guest physical memory | Guest mapping plus host mapping reaches RAM | Translation/TLB pressure |
| Virtual device | Disk/network interface | Emulation or paravirtual driver performs I/O | Copying and exits |
A Container Is an Isolated Process Group, Not a Tiny VM
Control what processes see
PID, mount, network, IPC, UTS, user and cgroup namespaces create separate views of global kernel resources.
Control what processes consume
Account for and limit CPU, memory, I/O and process counts. A namespace changes visibility; a cgroup changes resource policy.
Images plus writable layer
Read-only image layers are shared. Copy-on-write gives each running container a private writable layer; persistent data belongs in volumes.
container = processes + namespaces + cgroups + filesystem view
image ≠ running container
shared kernel ≠ no isolation
Build an immutable image
Pin dependencies, use a minimal trusted base and avoid embedding secrets.
Create isolated process state
The runtime prepares namespaces, cgroups, mounts, capabilities and security policy.
Start the declared process
The application becomes the container's PID 1 and must handle signals and child reaping correctly.
Observe and replace
Logs, metrics and health checks reveal state; deployments replace failed or outdated instances.
Choose the Boundary from Workload Requirements
READY
Select a workload
The recommendation will balance boundary strength, compatibility, startup time and density.
Isolation Is a Layered Claim, Not a Checkbox
Drop root and capabilities
Run with the smallest identity and capability set, make filesystems read-only where practical and block privilege escalation.
Segment networks and secrets
Default-deny traffic, mount only necessary data and inject short-lived secrets rather than baking credentials into images.
Patch every layer
Scan dependencies and images, update host kernels/runtimes and verify image origin. A stale base layer remains vulnerable.
| Dimension | Virtual machine | Container |
|---|---|---|
| Kernel | Separate guest kernel | Shares host kernel |
| Startup | Usually seconds or longer | Usually faster |
| Density | Lower due to guest OS overhead | Higher for similar services |
| OS compatibility | Can run a different guest OS | Must use compatible host kernel |
| Security boundary | Typically stronger kernel separation | Requires careful kernel/runtime hardening |
Trace a Container from Image to Stopped Process
Ten Virtualization Questions
Answered correctly: 0 of 10
- Compare hypervisor types.
- Explain trap and emulate.
- Describe nested paging.
- Explain namespaces.
- Explain cgroups.
- Container versus VM?
- Why is PID 1 special?
- Why are volumes needed?
- Can a container run any OS?
- How do you isolate untrusted code?
- Inspect namespaces.
- Set a memory limit.
- Build a minimal image.
- Handle termination signals.
- Document a threat model.
LEVEL 14 SUMMARY
You Can Compare Isolation Architectures
- Hypervisors multiplex hardware among complete guest operating systems.
- Containers isolate process groups while sharing the host kernel.
- Namespaces control views; cgroups account and limit consumption.
- Images are immutable templates; containers add runtime state.
- Real security combines boundaries, least privilege, patching and monitoring.
COURSE CHECKPOINT
Mark complete after defending a VM/container choice from explicit requirements.
Saved in this browser.