3.6. Container Management
Containers package an application and its dependencies into an isolated unit that runs on a shared kernel. They're not VMs — they're processes with enhanced isolation via Linux namespaces and cgroups. The XK0-006 exam tests practical container operations: building images, running containers, managing volumes, and configuring container networking.
💡 First Principle: A container is a process running in namespaces (isolated views of PID space, network, filesystem, users) with resource limits enforced by cgroups. The container image is a layered read-only filesystem. When you run a container, a thin writable layer is added on top — the image itself never changes.
⚠️ Common Misconception (M4): Docker and Podman have largely compatible CLI syntax, but they differ fundamentally in architecture. Docker uses a privileged background daemon (dockerd) running as root — a security concern. Podman is daemonless and rootless by default, running containers as the current user. This affects networking, SELinux contexts on volumes, and how services are managed (Podman containers can be managed by systemd directly).
