How the security of operating-system-level virtualization (containers) compares to hypervisor-based virtual machines. A hypervisor runs and strongly isolates full guest operating systems at the cost of high overhead; OS-level virtualization instead runs many lightweight instances on a single shared host kernel, gaining efficiency and resource utilization but weakening isolation because all containers share one kernel. Understanding this trade-off requires the container creation life-cycle, a container threat model mapping the attack vectors of container systems (kernel sharing, container escape, resource abuse), and a case study of the isolation containers actually provide. A foundational treatment of virtualization security and the isolation-versus-efficiency trade-off between VMs and containers.
A survey of the security properties of operating-system-level virtualization (containers) relative to hypervisor-based virtual machines. It first establishes core virtualization concepts—how a hyperv…