container
termcloudprogramming
A process isolated by kernel features rather than by a separate operating system - sharing the host's kernel with everything else running on it.
The shared kernel is the whole trade. It makes containers fast to start and cheap to run, and it means the isolation boundary is a set of kernel features rather than a hardware one, so a kernel vulnerability is a boundary vulnerability. That is why the interesting security questions are about what the container may ask the kernel to do - capabilities, syscall filtering, whether it runs as root - rather than about the image, and why a compromised container on a shared host is a different conversation from a compromised virtual machine.
Also known as: docker, oci