Docker
containercontainer-engineopen sourceThe ubiquitous container runtime, namespaces + cgroups + a default seccomp/AppArmor profile, that shares the host kernel.
Docker is the most widely used container engine. A container is namespaces (private view) plus cgroups (resource limits) plus a default seccomp and AppArmor profile and dropped capabilities. That is meaningful process/filesystem/network separation, but not a hard boundary: root-in-container, --privileged, or a mounted Docker socket make host escape trivial. On macOS and Windows, Docker runs its containers inside a Linux VM. The default reality is real reproducibility and moderate isolation on a shared kernel.
Strengths
- Ubiquitous tooling, images, and ecosystem
- Meaningful default hardening: seccomp + AppArmor profiles, dropped caps
- Excellent reproducibility for trusted code
Limitations
- Shared kernel, not a hard boundary; a kernel LPE escapes it
- root-in-container, --privileged, or a mounted docker.sock make escape trivial
- On macOS/Windows it runs inside a Linux VM, so containers are never free there
Files & editor
desktop-mountBind-mount your project and your host editor edits it directly; VS Code Dev Containers attaches seamlessly.
How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.