What is meant by shared kernel in Docker?

by

when we pull ubuntu image then it have different kernel

No it does not: it does not have the kernel part: it relies on the kernel of the host (the one running docker engine) for all system calls.

As mentioned in “Docker vs Virtualization“:

Initially Docker was built as an abstraction layer on top of Linux Containers (LXC). LXC itself is a just an API for the Linux containment features.
Starting with Docker 0.9, LXC is not the default anymore and has been replaced with a custom library (libcontainer) written in Go. Overall libcontainer’s advantage is a more consistent interface to the Kernel across various Linux distributions. The only gotcha is that it requires Linux 3.8 and higher.

See more at “Why Understanding User Space vs. Kernel Space Matters“.
Also “Operating System Containers vs. Application Containers“:

Containers are the products of operating system virtualization. They provide a lightweight virtual environment that groups and isolates a set of processes and resources such as memory, CPU, disk, etc., from the host and any other containers.
The isolation guarantees that any processes inside the container cannot see any processes or resources outside the container.

https://risingstack-blog.s3-eu-west-1.amazonaws.com/2015/05/os-virtualization.jpg

OS containers are virtual environments that share the kernel of the host operating system but provide user space isolation

https://risingstack-blog.s3-eu-west-1.amazonaws.com/2015/05/os-containers.jpg

As mentioned in “Do all Linux distros use the same kernel?“, a kernel can be shared accross distro, even if each distro has its own configuration of the kernel.

If you need more isolation, consider gVisor (https://github.com/google/gvisor), a container sandbox runtime focused on security, efficiency, and ease of use. (2018).
See Architecture:

https://gvisor.dev/docs/architecture_guide/Layers.png

gVisor intercepts application system calls and acts as the guest kernel, without the need for translation through virtualized hardware.

gVisor may be thought of as either a merged guest kernel and VMM, or as seccomp on steroids.
This architecture allows it to provide a flexible resource footprint (i.e. one based on threads and memory mappings, not fixed guest physical resources) while also lowering the fixed costs of virtualization.
However, this comes at the price of reduced application compatibility and higher per-system call overhead.

More Related Contents:

  1. How to Dockerize windows application
  2. Why docker container exits immediately
  3. Add a volume to Docker, but exclude a sub-folder
  4. Use of Supervisor in docker
  5. How to change the docker image installation directory?
  6. Locating data volumes in Docker Desktop (Windows)
  7. In a Dockerfile, How to update PATH environment variable?
  8. How to remove old Docker containers
  9. How to keep Docker container running after starting services?
  10. How to show the run command of a docker container
  11. How to make sure docker’s time syncs with that of the host?
  12. what is docker run -it flag?
  13. Cannot login to Docker account
  14. Conditional ENV in Dockerfile
  15. In Docker, what’s the difference between a container and an image? [duplicate]
  16. Docker Compose – How to execute multiple commands?
  17. Is there a way to combine Docker images into 1 container?
  18. How do I access a spring app running in a docker container?
  19. Are you trying to mount a directory onto a file (or vice-versa)?
  20. How to pass ARG value to ENTRYPOINT?
  21. How to link containers in docker?
  22. How to restart a single container with docker-compose
  23. Error “Get https://registry-1.docker.io/v2/: net/http: request canceled” while building image
  24. What work does the process in container “gcr.io/google_containers/pause:0.8.0” do?
  25. How to increase/check default memory Docker has on Linux?
  26. How to SSH into Docker?
  27. asp.net core 2.0 – multiple projects solution docker file
  28. docker-compose: difference between networks and links
  29. What is the use of Docker ‘host’ and ‘none’ Networks?
  30. What is the purpose of the file “docker.sock”?

Leave a Comment