virtualization - What is meant by shared kernel in Docker?

Question

In Docker ,guest OS share same kernel as Host OS have .

Can someone elaborate more on it.

Let I have centos os which have some kernel version ,when we pull ubuntu image then it have different kernel ,then how can we say that they have same kernel?

Answer 1

when we pull ubuntu image then it have different kernel

No it does not: it does not have the kernel part: it relies on the kernel of the host (the one running docker engine) for all system calls.

As mentioned in "Docker vs Virtualization":

Initially Docker was built as an abstraction layer on top of Linux Containers (LXC). LXC itself is a just an API for the Linux containment features.
Starting with Docker 0.9, LXC is not the default anymore and has been replaced with a custom library (libcontainer) written in Go. Overall libcontainer’s advantage is a more consistent interface to the Kernel across various Linux distributions. The only gotcha is that it requires Linux 3.8 and higher.

See more at "Why Understanding User Space vs. Kernel Space Matters".
Also "Operating System Containers vs. Application Containers":

Containers are the products of operating system virtualization. They provide a lightweight virtual environment that groups and isolates a set of processes and resources such as memory, CPU, disk, etc., from the host and any other containers.
The isolation guarantees that any processes inside the container cannot see any processes or resources outside the container.

OS containers are virtual environments that share the kernel of the host operating system but provide user space isolation

As mentioned in "Do all Linux distros use the same kernel?", a kernel can be shared accross distro, even if each distro has its own configuration of the kernel.

---

If you need more isolation, consider gVisor (https://github.com/google/gvisor), a container sandbox runtime focused on security, efficiency, and ease of use. (2018).
See Architecture:

gVisor intercepts application system calls and acts as the guest kernel, without the need for translation through virtualized hardware.

gVisor may be thought of as either a merged guest kernel and VMM, or as seccomp on steroids.
This architecture allows it to provide a flexible resource footprint (i.e. one based on threads and memory mappings, not fixed guest physical resources) while also lowering the fixed costs of virtualization.
However, this comes at the price of reduced application compatibility and higher per-system call overhead.