Interview prompt
Explain containers package processes with shared-kernel isolation to an engineer who understands the surrounding system but has not used this technique. Walk from its contract to a concrete operation, then discuss where it fails or becomes expensive.
A strong answer
A container is a way to package a process and its dependencies while applying isolation and resource controls. On Linux, containers commonly use namespaces to present scoped views of resources and control groups to account for or limit resource consumption. Containers generally share the host kernel.
A container image supplies filesystem layers and runtime configuration. At launch, the container runtime creates a process with selected namespaces, mounts, capabilities, and cgroup limits. The process still uses the host kernel’s system-call interface, which is why kernel compatibility and security policy matter.
A complete answer also calls out the assumptions that control correctness. Containers are not virtual machines with a separate guest kernel by default. A container can escape intended boundaries if host configuration or privileges are unsafe. Resource limits can prevent one process from consuming all memory, but hard limits also cause throttling or termination when set too low.
Close by describing one representative test or measurement. A container works on a developer laptop but fails on a server with an architecture mismatch. Identify what an image does and does not guarantee about the kernel and CPU.
Follow-up questions
Answer the follow-ups in the frontmatter. Use the linked article for the concept and the trace to make the explanation concrete.