Containers vs VMs interview questions

1. A.A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel
2. B.Linux control groups that limit and account for a container's CPU, memory, I/O and other resource usage
3. C.a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
4. D.Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem

Answer + AI explanation with Pro

1. A.container vs VM
2. B.cgroups
3. C.microVM (Firecracker)
4. D.Kata Containers

Answer + AI explanation with Pro

1. A.container vs VM — A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle
2. B.container vs VM — VMs virtualize hardware with a full guest OS; containers share the host kernel and isolate via namespaces and cgroups.
3. C.container vs VM — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
4. D.container vs VM — A runtime that wraps each container or pod in a lightweight VM, combining container workflow with hypervisor-grade isolation

Answer + AI explanation with Pro

1. A.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor
2. B.Minimal KVM-based VMs booting in milliseconds, used by serverless platforms for strong isolation at scale.
3. C.A runtime that wraps each container or pod in a lightweight VM, combining container workflow with hypervisor-grade isolation
4. D.Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources

Answer + AI explanation with Pro

1. A.Namespaces
2. B.Container vs VM isolation
3. C.Linux namespaces
4. D.Confidential containers

Answer + AI explanation with Pro

1. A.Linux namespaces — Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem
2. B.Linux namespaces — Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
3. C.Linux namespaces — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
4. D.Linux namespaces — Linux kernel feature limiting and accounting CPU, memory, and I/O for container processes.

Answer + AI explanation with Pro

1. A.VMs virtualize hardware with a full guest OS; containers share the host kernel and isolate via namespaces and cgroups.
2. B.Linux control groups that limit and account for a container's CPU, memory, I/O and other resource usage
3. C.Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
4. D.A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle

Answer + AI explanation with Pro

1. A.cgroups
2. B.microVM (Firecracker)
3. C.microVM
4. D.OCI runtime

Answer + AI explanation with Pro

1. A.cgroups — Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.
2. B.cgroups — A minimal virtual machine with a stripped device model and fast boot (Firecracker, Cloud Hypervisor) used to isolate serverless and container workloads
3. C.cgroups — Linux control groups that limit and account for a container's CPU, memory, I/O and other resource usage
4. D.cgroups — A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel

Answer + AI explanation with Pro

1. A.A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle
2. B.Containers run inside confidential VMs (SEV-SNP/TDX) so workload memory is shielded from the host and platform operator
3. C.A runtime that wraps each container or pod in a lightweight VM, combining container workflow with hypervisor-grade isolation
4. D.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor

Answer + AI explanation with Pro

1. A.container vs VM
2. B.Kata Containers
3. C.Linux namespaces
4. D.Container image layers

Answer + AI explanation with Pro

1. A.Kata Containers — Minimal KVM-based VMs booting in milliseconds, used by serverless platforms for strong isolation at scale.
2. B.Kata Containers — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
3. C.Kata Containers — A runtime that wraps each container or pod in a lightweight VM, combining container workflow with hypervisor-grade isolation
4. D.Kata Containers — Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.

Answer + AI explanation with Pro

1. A.a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
2. B.Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
3. C.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor
4. D.A minimal virtual machine with a stripped device model and fast boot (Firecracker, Cloud Hypervisor) used to isolate serverless and container workloads

Answer + AI explanation with Pro

1. A.Kata Containers
2. B.Namespaces
3. C.microVM (Firecracker)
4. D.microVM

Answer + AI explanation with Pro

1. A.microVM — A user-space application kernel that intercepts syscalls to sandbox containers without a full VM.
2. B.microVM — A minimal virtual machine with a stripped device model and fast boot (Firecracker, Cloud Hypervisor) used to isolate serverless and container workloads
3. C.microVM — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
4. D.microVM — Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources

Answer + AI explanation with Pro

1. A.A minimal virtual machine with a stripped device model and fast boot (Firecracker, Cloud Hypervisor) used to isolate serverless and container workloads
2. B.A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel
3. C.Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.
4. D.Minimal KVM-based VMs booting in milliseconds, used by serverless platforms for strong isolation at scale.

Answer + AI explanation with Pro

1. A.microVM
2. B.Windows Hyper-V isolation mode
3. C.OCI runtime
4. D.cgroups

Answer + AI explanation with Pro

1. A.Windows Hyper-V isolation mode — Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
2. B.Windows Hyper-V isolation mode — A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel
3. C.Windows Hyper-V isolation mode — Linux kernel feature limiting and accounting CPU, memory, and I/O for container processes.
4. D.Windows Hyper-V isolation mode — A user-space application kernel that intercepts syscalls to sandbox containers without a full VM.

Answer + AI explanation with Pro

1. A.Linux control groups that limit and account for a container's CPU, memory, I/O and other resource usage
2. B.Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
3. C.A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle
4. D.Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem

Answer + AI explanation with Pro

1. A.gVisor
2. B.OCI runtime
3. C.Container image layers
4. D.microVM (Firecracker)

Answer + AI explanation with Pro

1. A.Container image layers — Containers run inside confidential VMs (SEV-SNP/TDX) so workload memory is shielded from the host and platform operator
2. B.Container image layers — A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel
3. C.Container image layers — Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem
4. D.Container image layers — Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.

Answer + AI explanation with Pro

1. A.A Windows container mode that runs each container inside a lightweight utility VM for kernel isolation, versus process-isolation sharing the host kernel
2. B.Linux kernel feature limiting and accounting CPU, memory, and I/O for container processes.
3. C.Containers run inside confidential VMs (SEV-SNP/TDX) so workload memory is shielded from the host and platform operator
4. D.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor

Answer + AI explanation with Pro

1. A.Confidential containers
2. B.microVM
3. C.container vs VM
4. D.Namespaces

Answer + AI explanation with Pro

1. A.Confidential containers — Containers run inside confidential VMs (SEV-SNP/TDX) so workload memory is shielded from the host and platform operator
2. B.Confidential containers — Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.
3. C.Confidential containers — Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem
4. D.Confidential containers — Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor

Answer + AI explanation with Pro

1. A.Kernel isolation of PID, network, mount, UTS, IPC, and user views giving each container its own world.
2. B.Linux control groups that limit and account for a container's CPU, memory, I/O and other resource usage
3. C.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor
4. D.A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle

Answer + AI explanation with Pro

1. A.cgroups
2. B.Container image layers
3. C.OCI runtime
4. D.Linux namespaces

Answer + AI explanation with Pro

1. A.OCI runtime — Kernel isolation of PID, network, mount, UTS, IPC, and user views giving each container its own world.
2. B.OCI runtime — Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem
3. C.OCI runtime — A container runtime conforming to the Open Container Initiative spec (runc, crun, kata-runtime) that creates and runs containers from a bundle
4. D.OCI runtime — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)

Answer + AI explanation with Pro

1. A.Minimal KVM-based VMs booting in milliseconds, used by serverless platforms for strong isolation at scale.
2. B.Kernel isolation primitives (pid, net, mnt, uts, ipc, user) that give a container its own view of process, network and filesystem resources
3. C.Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor
4. D.Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem

Answer + AI explanation with Pro

1. A.Container vs VM isolation
2. B.Pod sandbox isolation
3. C.Confidential containers
4. D.container vs VM

Answer + AI explanation with Pro

1. A.Pod sandbox isolation — Lightweight VMs presenting an OCI container interface, adding hardware isolation to untrusted workloads.
2. B.Pod sandbox isolation — Stacked read-only filesystem layers that compose a container image, with a thin writable layer added at runtime via a union filesystem
3. C.Pod sandbox isolation — a container shares the host kernel (lightweight); a VM virtualizes hardware (strong isolation)
4. D.Pod sandbox isolation — Running pods inside microVMs (Kata) or user-space kernels (gVisor) to give container orchestration the security boundary of a hypervisor

Answer + AI explanation with Pro