48. [NEW] Virtualization — Hypervisors vs Containers

A natural follow-up to COW/Docker (§33) and kernel architecture (§47): how do VMs differ from containers?

Type 1 Hypervisor (bare-metal) — runs directly on hardware, with no host OS underneath. Examples: VMware ESXi, Microsoft Hyper-V, Xen, KVM (technically a Linux kernel module that turns Linux itself into a Type-1-style hypervisor). Used in data centers/cloud — better performance and isolation.

+------------------------------------------------+
|   VM 1 (Guest OS)   |   VM 2 (Guest OS)         |
+------------------------------------------------+
|              Hypervisor (Type 1)                |
+------------------------------------------------+
|                   Hardware                       |
+------------------------------------------------+

Type 2 Hypervisor (hosted) — runs as an application on top of a host OS. Examples: VirtualBox, VMware Workstation, Parallels. Simpler to use (just an app), but an extra layer of overhead versus Type 1. Common on developer laptops.

+------------------------------------------------+
|   VM 1 (Guest OS)   |   VM 2 (Guest OS)         |
+------------------------------------------------+
|         Hypervisor (Type 2, an application)     |
+------------------------------------------------+
|                   Host OS                        |
+------------------------------------------------+
|                   Hardware                       |
+------------------------------------------------+

VMs vs Containers — the key distinction: a VM virtualizes the hardware — each VM runs its own full guest OS kernel, so a Linux host can run a Windows guest. A container virtualizes the OS — containers share the host's kernel (via Linux namespaces for isolation and cgroups for resource limits) and only package the application plus its userspace dependencies. This is why containers start in milliseconds and are lightweight (no kernel to boot), while VMs take longer to boot and carry a full extra OS's memory/disk footprint — but VMs give stronger isolation (a container escape can, in principle, reach the shared host kernel; a VM escape has to break out of the hypervisor itself).

VM Container
Virtualizes	Hardware	Operating system
Kernel	Own guest kernel per VM	Shares host kernel
Boot time	Seconds–minutes	Milliseconds
Isolation	Strong (separate kernel)	Weaker (shared kernel)
Overhead	High (full OS each)	Low
Can run a different OS?	Yes (Windows guest on Linux host)	No (must match host kernel type)
Example	VMware, VirtualBox, EC2 instances	Docker, Podman

How this connects to COW (§33): Docker's image layers use a copy-on-write filesystem so multiple containers sharing a base image only store their own diffs — this is the same COW principle used by fork(), just applied at the filesystem layer instead of the page-table layer.

One-liner: a hypervisor virtualizes hardware so each guest gets its own OS kernel (Type 1 = bare-metal, faster, used in the cloud; Type 2 = hosted app, simpler, used on laptops); a container virtualizes the OS itself, sharing the host kernel via namespaces/cgroups, trading some isolation for near-zero overhead and instant startup.

---

End of notes.