Q2: Containers vs. Virtual Machines: How do Linux Namespaces and Control Groups (cgroups) isolate processes? - DevOps & Kubernetes (50 Qs)

Direct Architecture Explanation

A Virtual Machine (VM) virtualizes hardware through a hypervisor (Type 1 or Type 2) and runs a completely separate guest operating system with its own kernel. A container virtualizes the operating system; it runs as a standard Linux process directly on the host kernel, isolated by kernel features: Namespaces (what the process can see) and cgroups (what the process can use).

sql

       +-----------------------+               +-----------------------+
       |   Virtual Machine     |               |       Container       |
       |  +-----------------+  |               |  +-----------------+  |
       |  | App & User Space|  |               |  | App & User Space|  |
       |  +-----------------+  |               |  +-----------------+  |
       |  |  Guest Kernel   |  |               |  | Linux Namespaces|  |
       |  +-----------------+  |               |  | & cgroups Limits|  |
       |  | Virtual Hardware|  |               |  +-----------------+  |
       +-----------------------+               +-----------------------+
                   |                                       |
                   v                                       v
       +-----------------------+               +-----------------------+
       |       Hypervisor      |               |      Host Kernel      |
       +-----------------------+               +-----------------------+
       |      Host Hardware    |               |     Host Hardware     |
       +-----------------------+               +-----------------------+

1. Linux Namespaces (Visibility Boundaries)

Namespace	Flag	Isolation Provided
PID	`CLONE_NEWPID`	Process IDs. Container process sees itself as PID 1, isolated from host PIDs.
NET	`CLONE_NEWNET`	Network devices, IP addresses, IP routing tables, port bindings, and firewall rules.
MNT	`CLONE_NEWNS`	Filesystem mount points. Container sees its own isolated root filesystem (`chroot` / `pivot_root`).
IPC	`CLONE_NEWIPC`	System V IPC and POSIX message queues, shared memory segments.
UTS	`CLONE_NEWUTS`	Hostname and NIS domain name.
USER	`CLONE_NEWUSER`	Maps container UID 0 (root inside container) to non-root UID (e.g. UID 10001) on the host.

2. Control Groups (cgroups v1 & v2 Resource Metering)

While Namespaces restrict visibility, cgroups restrict resource consumption:

CPU limits: Enforced via the Linux Completely Fair Scheduler (CFS) quota (cpu.cfs_quota_us and cpu.cfs_period_us).
Memory limits: Enforced via memory.max (cgroups v2) or memory.limit_in_bytes (v1). If a container exceeds this, the kernel OOM killer terminates it (OOMKilled / exit code 137).
Block I/O & PIDs: Restricts disk read/write bandwidth (io.weight) and limits maximum process counts (pids.max) to block fork-bombs.