Ask almost any developer to explain what a Docker container is, and you will usually get a diagram contrasting two towers:

On the left sits a Virtual Machine: an Operating System, a Guest Kernel, a Hypervisor, and virtual hardware drivers weighing several gigabytes.

On the right sits a Container: a slender box labeled "App and Dependencies" sitting directly on top of the "Host OS and Docker Engine."

The conclusion is invariably recited like gospel:

"Virtual machines virtualize the hardware. Containers virtualize the operating system. Containers are just lightweight virtual machines."

It is a convenient mental model for slide decks. It is also completely wrong.

There is no such thing as a "container" inside the Linux kernel.…