What is meant by shared kernel in Docker?

Question

In Docker ,guest OS share same kernel as Host OS have .

Can someone elaborate more on it.

Let I have centos os which have some kernel version ,when we pull ubuntu image then it have different kernel ,then how can we say that they have same kernel?

Answer 1

when we pull ubuntu image then it have different kernel

No it does not: it does not have the kernel part: it relies on the kernel of the host (the one running docker engine) for all system calls.

As mentioned in "Docker vs Virtualization":

Initially Docker was built as an abstraction layer on top of Linux Containers (LXC). LXC itself is a just an API for the Linux containment features.
Starting with Docker 0.9, LXC is not the default anymore and has been replaced with a custom library (libcontainer) written in Go. Overall libcontainer’s advantage is a more consistent interface to the Kernel across various Linux distributions. The only gotcha is that it requires Linux 3.8 and higher.

See more at "Why Understanding User Space vs. Kernel Space Matters".
Also "Operating System Containers vs. Application Containers":

Containers are the products of operating system virtualization. They provide a lightweight virtual environment that groups and isolates a set of processes and resources such as memory, CPU, disk, etc., from the host and any other containers.
The isolation guarantees that any processes inside the container cannot see any processes or resources outside the container.

OS containers are virtual environments that share the kernel of the host operating system but provide user space isolation

As mentioned in "Do all Linux distros use the same kernel?", a kernel can be shared accross distro, even if each distro has its own configuration of the kernel.

---

If you need more isolation, consider gVisor (https://github.com/google/gvisor), a container sandbox runtime focused on security, efficiency, and ease of use. (2018).
See Architecture:

gVisor intercepts application system calls and acts as the guest kernel, without the need for translation through virtualized hardware.

gVisor may be thought of as either a merged guest kernel and VMM, or as seccomp on steroids.
This architecture allows it to provide a flexible resource footprint (i.e. one based on threads and memory mappings, not fixed guest physical resources) while also lowering the fixed costs of virtualization.
However, this comes at the price of reduced application compatibility and higher per-system call overhead.

Answer 2

Docker was using LinuX Containers (LXC) earlier, but switched to runC (formerly known as libcontainer), that runs in the same operating system as its host. This allows it to share a lot of the host operating system resources. It also uses layered filesystems like AuFS. It also manages the networking for you as well.

AuFS is a layered file system, so you can have a read only part, and a write part, and merge those together. So you could have the common parts of the operating system as read only, which are shared amongst all of your containers, and then give each container its own mount for writing.

So let's say you have a container image that is 1GB in size. If you wanted to use a Full VM, you would need to have 1GB times x number of VMs you want. With LXC and AuFS you can share the bulk of the 1GB and if you have 1000 containers you still might only have a little over 1GB of space for the containers OS, assuming they are all running the same OS image.