"it uses a hypervisor to launch your docker image, but not a full blown VM"

I don't understand this. Isn't using a hypervisor the same as using a VM? How is this different from using VMware, Xen, etc. to run a stripped down VM with a tiny kernel inside to handle Docker?

So there _is_ still a guest OS inside a hardware virtual machine, it's just a stripped down OS?

Depend on how one define OS. If kernel=OS, then yes, it is stripped down one. But HyperContainer is different from container OS, like coreos, that it is just a kernel, no rootfs.

Yes, even if it's "just a kernel", it's still an operating system. It's a piece of software that runs in the supervisor mode of the CPU, providing system call services to user applications.

The marketing copy appears, on this basis, to be somewhat misleading. It says on the site that this is a cloud where "multi-tenant containers can inherently be run safely side by side on bare metal, instead of being nested in VMs".

I think that, as an industry, we've established that "bare metal" execution of workloads means _without_ the multi-layered approach of a hypervisor (itself an OS) running a separate guest OS kernel.

Thanks. I remember a blog post that coined a term "virtualized container", but cannot find the link right now.

I wouldn't use the word VM, as it reminds us of the heavy full-blown images. It is probably more misleading to say that HyperContainer launches your Docker image in VMs. But you are right, it is still new and requires efforts to get people understand.

I don't know if I would describe VMs as heavy. But to the extent that they are heavy, it's because they are an application and OS running on virtualized (i.e. partially or fully emulated) hardware rather than physical hardware.

[Edit: Removed rest of comment to limit negativity. Thank you for responding to clarify.]

Let me be more clear. The problem of VM is not virtualization (or hypervisor), the problem is "Machine". For a long time, we try to emulate a complete machine with a complete "OS" running atop. What Docker really changed is to make us realize that all we need is the app, not a full OS. Therefore Docker image is an app-centric package, nothing specific to Linux container. Yes, it runs with Linux container, but you can also launch it with a hypervisor in 100ms.

Shall we call hypervisor+kernel+Docker image VM? I don't think so. It never tries to give you a complete machine, neither a full OS. Personally I like "virtualized container". But the combination of these two words might be more confusing, given that whenever you see the word "container", you think of Linux container.

OS size is just one problem with Virtual Machines. (Much of the OS is idle unless explicitly used anyway.) Other significant problems include:

- inefficient use of resources resulting from functionality duplicated in both the hypervisor and the guest (e.g., two TCP stacks, two filesystem implementations, two schedulers, and so on). (That's why I asked about this in a separate comment.)

- inefficient use of resources resulting from the inability to dynamically share resources between VMs (e.g., memory and disk typically have to be statically allocated to VMs, instead of sharing a common pool the way processes within a single Unix-like system typically do).

- poor visibility from the hypervisor into the application (i.e., observability tools cannot typically cross the hardware-virtualization boundary).

That's just a partial list.

I think that's why you're seeing pushback from people insisting that these be called VMs rather than containers: they have all of the above downsides of VMs, even if the operating system surface area isn't that large.

[edited for formatting]

Thank you for responding to clarify.

What parts of a machine do traditional data center VMs emulate that Hyper avoids?

What system functions normally supported by a guest OS will Hyper not need to support? (E.g., memory management, network stack?)

So, yes, an OS. This isn't like a software isolated process in Singularity or little component in a user-mode runtime leveraging a L4-like microkernel. It's virtualization + a kernel + (maybe something here) + my code.

That's a stripped-down, guest OS on virtualized platform. Basically same sort of thing that's common but with some differentiator.

Does this kernel run its own TCP stack and filesystem?

TCP yes, but the filesystem is provided by the Docker image.

I meant a filesystem implementation (i.e., kernel code actually implementing the filesystem system calls from the application, either by reading and writing blocks from a block-device provided by the hypervisor or using a network file protocol).

It sounds like this is part of the guest kernel.

[edited to flesh out what I meant]