Ok, yes, but that's just the kernel, and it's cheap only relative to a full VM. A container may or may not be cheap depending on the language runtime and whatever helper apps you're bundling. Bundling the python interpreter or a Java VM into every app isn't cheap.

This reminds me of early web servers and CGI's. A CGI can be relatively cheap to run as long as you write it in C and don't link in too much; not so much for a scripting language.

Redundancy can happen at multiple layers, so deduplicating at one layer might not be enough, depending on the situation.

Fair enough, although it is the case if the host OS is different then the container, VM would be a better name then I guess.

So maybe not kernel, but the entire userland/OS of the app is still statically linked with containers.

> Fair enough, although it is the case if the host OS is different then the container, VM would be a better name then I guess.

If the host OS is different than the container's you need either an intermediate hypervisor / VM (pretty sure that's what happens for docker on OSX, and why it's much more expensive than on linux) or for the host to provide an ABI compatible with the VM's OS/expectations (WSL, smartos's branded zones).

Either adds even more "dynamic linking" to the pile.

> So maybe not kernel, but the entire userland/OS of the app is still statically linked with containers.

Yes, a container's userland should be statically linked.

>the entire point is to have multiple isolated userlands use the same underlying kernel. That's why they're so cheap.

Ironically, this is what Plan9 does out-of-the-box. And even cheaper.

Do you have any evidence to support your claim? My understanding is that containerized processes are theoretically the same as any other process on the system in terms of runtime performance.

In plan9 they are exactly the same, not theoretically. Isolation happens on a file system level (everything is a file, but truly, not a "special device file").

While it's practically not possible to compare performance, just the fact that this is a part of the initial design and a core of Plan9 vs adhoc feature (actually ported from Plan to Linux) is enough to speculate on performance.

>Linux namespaces were inspired by the more general namespace functionality used heavily throughout Plan 9 from Bell Labs.

https://en.wikipedia.org/wiki/Cgroups

> While it's practically not possible to compare performance, just the fact that this is a part of the initial design and a core of Plan9 vs adhoc feature (actually ported from Plan to Linux) is enough to speculate on performance.

It really doesn't. For all we know, because the plan9 version has to be more general it is much slower than the ad-hoc version.