DevOps Engineer interview question
What is the difference between containers and virtual machines?
Virtual machines emulate hardware and run separate kernels, giving stronger isolation at higher overhead; containers share the host kernel and package processes, starting faster and denser but with a shared security boundary.
Direct answer
What a strong answer covers
How it works
A virtual machine runs its own kernel on virtualised hardware managed by a hypervisor, so each VM boots like a computer, takes seconds to minutes to start, and isolates workloads at the hardware boundary. A container is a process on the host kernel confined by namespaces, cgroups, and a filesystem image, so it starts in milliseconds, shares the kernel’s memory and cache, and packs far more densely. The shared kernel is also the shared risk: a kernel exploit from inside a container reaches the host, which is why multi-tenant platforms wrap containers in microVMs or sandboxes. Most fleets run containers on VMs and get both.
Example
A CI platform runs each job in a container on a pool of VMs: containers give fast start and a reproducible image per job, VMs give the tenant boundary between customers. Untrusted code from customers runs in gVisor or Firecracker microVMs instead of plain containers, accepting slower start for kernel isolation.
Common mistakes
- Claiming containers are lightweight VMs with the same isolation.
- Running root inside containers with host mounts and calling it isolated.
- Choosing VMs for a stateless web tier that would scale faster and cheaper as containers.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.