What is containerization?
Explore Red Hat OpenShift on IBM Cloud Subscribe for cloud updates
Illustration with collage of pictograms of computer monitor, server, clouds, dots

Published: 20 May 2024
Contributors: Stephanie Susnjara, Ian Smalley

What is containerization?

Containerization is the packaging of software code with just the operating system (OS) libraries and dependencies required to run the code to create a single lightweight executable—called a container—that runs consistently on any infrastructure.

More portable and resource-efficient than virtual machines (VMs), containers have become the de facto compute units of modern cloud-native applications.

Containerization allows developers to create and deploy applications faster and more securely. With traditional methods, developers write code in a specific computing environment, which, when transferred to a new location, often results in bugs and errors. For instance, this can happen when a developer transfers code from a desktop computer to a VM or from a Linux® to a Windows operating system. Containerization eliminates this problem by bundling the application code with the related configuration files, libraries and dependencies required for it to run. This single software package or “container” is abstracted away from the host operating system. Hence, it stands alone and becomes portable—able to run across any platform or cloud, free of issues.

The concept of containerization and process isolation is decades old. However, the emergence in 2013 of the open-source Docker—an industry standard for containers with simple developer tools and a universal packaging approach—accelerated the adoption of this technology. Today, organizations increasingly use containerization to create new applications and modernize existing applications for the cloud. 

According to a report from Forrester1, 74 percent of US infrastructure decision-makers say that their firms are adopting containers within a platform as a service (PaaS) in an on-premises or public cloud environment. 

Containers are “lightweight,” meaning they share the machine’s operating system kernel and do not require the overhead of associating an operating system within each application. Containers are inherently smaller in capacity than VMs and require less start-up time. This capability allows far more containers to run on the same compute capacity as a single VM. This capability drives higher server efficiencies and, in turn, reduces server and licensing costs.

Most importantly, containerization enables applications to be “written once and run anywhere” across on-premises data center, hybrid cloud and multicloud environments. 

This portability speeds development, prevents cloud vendor lock-in and offers other notable benefits like fault isolation, ease of management, simplified security and more.

The following video provides further explanation of containerization:

Realize the full value of your hybrid cloud

Connect and integrate your systems to prepare your infrastructure for AI.

Related content

Register for the guide on app modernization

Containerization architecture

Containerization architecture consists of four essential component layers.

Underlying IT infrastructure

The underlying IT infrastructure is a base layer that includes the physical compute resources (for example, desktop computer, bare-metal server).

Host operating system

This layer runs on the physical or virtual machine. The OS manages system resources and provides a runtime environment for container engines. 

Container image

Also referred to as a runtime engine, the container engine provides the execution environment for container images (read-only templates containing instructions for creating a container). Container engines run on top of the host OS and virtualize the resources for containerized applications. 

Containerized applications

This final layer consists of the software applications run in containers.

How does containerization work?

Containers encapsulate an application as a single executable package of software that bundles application code together with all of the related configuration files, libraries and dependencies required for it to run.

Containerized applications are “isolated,” meaning they do not bundle in a copy of the operating system. Instead, an open-source container runtime or container engine (like Docker runtime engine) is installed on the host’s operating system and becomes the conduit for containers to share an operating system with other containers on the same computing system.

Other container layers, like common binaries (bins) and libraries, can be shared among multiple containers. This feature eliminates the overhead of running an operating system within each application and makes containers smaller in capacity and faster to start up than VMs, driving higher server efficiencies. The isolation of applications as containers also reduces the chance that malicious code in one container will impact other containers or invade the host system.

The abstraction from the host operating system makes containerized applications portable and able to run uniformly and consistently across any platform or cloud. Containers can be easily transported from a desktop computer to a virtual machine (VM) or from a Linux to a Windows operating system. Containers will also run consistently on virtualized infrastructures or traditional bare metal servers, either on-premises or in a cloud data center. 

Containerization allows software developers to create and deploy applications faster and more securely, whether the application is a traditional monolith (a single-tiered software application) or a modular application built on microservices architecture. Developers can build new cloud-based applications from the ground up as containerized microservices, breaking a complex application into a series of smaller, specialized and manageable services. They can also repackage existing applications into containers (or containerized microservices) that use compute resources more efficiently.

Virtualization versus containerization

Containers are often compared to virtual machines (VMs) because both technologies enable significant compute efficiencies by allowing multiple types of software (Linux- or Windows-based) to run in a single environment. 

Virtualization utilizes a hypervisor, a software layer placed on a physical computer or server that allows the physical computer to separate its operating system and applications from its hardware. Virtualization technology allows multiple operating systems and software applications to run simultaneously and share a single physical computer or host machine’s resources (for example, CPU, storage and memory). For example, an IT organization can run both Windows and Linux or multiple versions of an operating system, along with various applications on the same server. 

Each application and its related file system, libraries and other dependencies—including a copy of the operating system (OS)—are packaged together as a VM. With multiple VMs running on a single physical machine, significant savings in capital, operational and energy costs can be achieved.

Containerization, on the other hand, uses compute resources even more efficiently. A container creates a single executable package of software that bundles application code together with all of its dependencies required for it to run. Unlike VMs, however, containers do not bundle in a copy of the OS. Instead, the container runtime engine is installed on the host system’s operating system, or “host OS,” becoming the conduit through which all containers on the computing system share the same OS.

Containers are often called “lightweight”—they share the machine’s OS kernel and do not require the overhead of associating an OS within each application (as is the case with a VM). Other container layers (common bins and libraries) can also be shared among multiple containers, making containers inherently smaller in capacity than a VM and faster to start up. Multiple containers can run on the same compute capacity as a single VM, driving even higher server efficiencies and reducing server and licensing costs.

The following video does a deeper dive on containers versus VMs:

Benefits of containerization

Containerization offers significant benefits to developers and development teams, especially in the following areas.

Portability

A container creates an executable package of software that is abstracted away from (not tied to or dependent upon) the host operating system. Hence, it is portable and able to run uniformly and consistently across any platform or cloud. 

Agility

Developing and deploying containers increases agility and allows applications to work in cloud environments that best meet business needs.  

Speed

Containers are “lightweight,” meaning they share the machine’s operating system (OS) kernel. This feature not only drives higher server efficiencies but also reduces server and licensing costs while speeding up start times, as there is no operating system to boot.

Fault isolation

Each containerized application is isolated and operates independently of others. The failure of one container does not affect the continued operation of any other containers. Development teams can identify and correct any technical issues within one container without any downtime in other containers. Also, the container engine can leverage any OS security isolation techniques—like SELinux access control—to isolate faults within containers.

Efficiency

Software running in containerized environments shares the machine’s OS kernel, and application layers within a container can be shared across containers. Thus, containers are inherently smaller in capacity than a VM and require less start-up time, allowing far more containers to run on the same compute capacity as a single VM. This capability increases resource optimization and drives server efficiencies, reducing server and licensing costs.

Ease of management

Containerization, particularly when paired with a container orchestration platform like Kubernetes, automates and simplifies provisioning, deployment and management of containerized applications.

Security

The isolation of applications as containers inherently prevents the invasion of malicious code from affecting other containers or the host system. Additionally, security permissions can be defined to automatically block unwanted components from entering containers or limit communications with unnecessary resources.

Containerization platforms and tools

As the growth of container-based solutions increased, the need for standards around container technology and the approach to packaging software code arose. The Open Container Initiative (OCI)2, a Linux project established in June 2015 by Docker and other industry leaders, emerged as a way to promote common, minimal, open standards and specifications around container technology. Since then, the OCI has helped broaden the choices for open-source engines so users can avoid vendor’s lock-in. Developers can also take advantage of OCI-certified technologies that allow them to build containerized applications by using a diverse set of DevOps tools and run these consistently on the infrastructure(s) of their choice.

To clear up any confusion, Docker also refers to Docker, Inc.3, the company that develops productivity tools built around Docker container technology. It also relates to the Docker open-source project4 to which Docker, Inc. and many other organizations and individuals contribute.

While Docker is the most well-known and highly used container engine technology, the broader ecosystem has standardized on containerd and other alternatives like CoreOS rkt, Mesos Containerizer, LXC Linux Containers, OpenVZ and crio-d.

Container orchestration and Kubernetes

Today an organization might have hundreds or thousands of containers—an amount that would be nearly impossible for teams to manage manually. This is where container orchestration comes in.

A container orchestration platform schedules and automates management like container deployment, networking, load balancing, scalability and availability.

Kubernetes, the most popular container orchestration tool available, is an open-source technology (originally open-sourced by Google, based on their internal project called Borg) that automates Linux container functions. Kubernetes works with many container engines, like Docker Engine. It also works with any container system that conforms to the Open Container Initiative (OCI) standards for container image formats and runtimes.

While Kubernetes is the industry standard, other popular container orchestration platforms include Apache Mesos, Nomad and Docker Swarm.

To learn more about container orchestration, check out this video that explains how Kubernetes works:

Containerization and cloud computing
Microservices and containerization

Containerization is an integral part of application modernization. This process refers to transforming monolithic (legacy) applications into cloud-native applications built on microservices architecture designed to integrate into any cloud environment.

Microservices are a superior approach to application development and management compared to the earlier monolithic model that combines a software application with the associated user interface and underlying database into a single unit on a single-server platform. With microservices, a complex application is broken up into a series of smaller, more specialized services, each with its own database and its own business logic. Microservices communicate across common interfaces (like APIs) and REST interfaces (like HTTP). By using microservices, development teams can focus on updating specific areas of an application without impacting it as a whole, resulting in faster development, testing and deployment.

The concepts behind microservices and containerization are similar. Both are software development practices that essentially transform applications into collections of smaller services or components that are portable, scalable, efficient and easier to manage. 

Moreover, microservices and containerization work well when used together. Containers provide a lightweight encapsulation of any application, whether a traditional monolith or a modular microservice. A microservice, developed within a container, then gains all of the inherent benefits of containerization, such as portability.

Overall, containers, microservices and cloud computing have merged, bringing application development and delivery to a new level. These technologies simplify DevOps workflows and support continuous integration and continuous delivery (CI/CD) pipelines for accelerated software development. These next-generation approaches have brought agility, efficiency and reliability to the software development lifecycle, leading to faster delivery of containerized apps and enhancements to users and the market.

Cloud migration and containerization

Organizations continue moving to the cloud, where users can develop applications quickly and efficiently. Containerization has become a critical business use case for cloud migration, the process of moving data, applications and workloads from an on-premises data center to cloud-based infrastructure or from one cloud environment to another.

Cloud migration is an essential part of an organization’s hybrid cloud environment, which combines on-prem, public and private cloud services to create a single, flexible, cost-effective IT infrastructure that supports and automates workload management across cloud environments.

Hybrid cloud and containerization

Today, cloud-based applications and data are accessible from any internet-connected device, allowing team members to work remotely and on the go. Cloud service providers (CSPs)—for example, Amazon Web Services (AWS), Google Cloud Services, IBM Cloud® or Microsoft Azure)—manage the underlying infrastructure, which saves organizations the cost of servers and other equipment and also provides automated network backups for additional reliability. Cloud infrastructures scale on demand and dynamically adjust computing resources, capacity and infrastructure as load requirements change. On top of that, CSPs regularly update offerings, giving users continued access to the latest innovative technologies, such as generative AI.

Containers as a service (CaaS)

Many of the top cloud service providers offer containers as a service (CaaS). Essentially a subset of infrastructure as a service (IaaS) , CaaS falls between IaaS and platform as a service (PaaS) in the cloud computing stack, providing a balance between the control offered by IaaS and the simplicity of PaaS.

CaaS provides a cloud-based platform where users can streamline container-based virtualization and container management processes. CaaS also provides container runtimes, orchestration layers and persistent storage management. In 2022, the global CaaS market was valued at nearly USD 2 billion.5 

Containerization versus serverless

Serverless computing (serverless) is an application development and execution model that enables developers to build and run application code without provisioning or managing servers or backend infrastructure.

In serverless computing, the cloud service provider allocates machine resources on demand, maintaining servers on behalf of their customers. Specifically, the developer and the CSP handle provisioning the cloud infrastructure required to run the code and scaling the infrastructure up and down on demand as needed. The provider adheres to a pay-as-you-go pricing model.

Serverless computing can improve developer productivity by enabling teams to focus on writing code, not managing infrastructure. In contrast, containers offer more control and flexibility, which can help manage existing applications and migrate them to the cloud. 

Containerization and security

Security practices for containerized environments require a strategy that spans the entire container lifecycle, including development, testing and deployment.

These practices must address all of the stack layers, including the containerization platform, container images, orchestration platform and individual containers and applications. 

First and foremost, container security policies must revolve around a zero trust framework. This model verifies and authorizes every user connection and ensures that the interaction meets the conditional requirements of the organization’s security policies. A zero-trust security strategy also authenticates and authorizes every device, network flow and connection based on dynamic policies, by using context from as many data sources as possible.

Container security has become a more significant concern as more organizations have come to rely on containerization technology, including orchestration platforms, to deploy and scale their applications. According to a report from Red Hat6, vulnerabilities and misconfigurations are top security concerns with container and Kubernetes environments. 

As previously mentioned, containerized applications inherently have a level of security since they can run as isolated processes and operate independently of other containers. Truly isolated, this might prevent any malicious code from affecting other containers or invading the host system. However, application layers within a container are often shared across containers. Regarding resource efficiency, this is a plus, but it also opens the door to interference and security breaches across containers. The same might be said of the shared operating system since multiple containers can be associated with the same host operating system. Security threats to the common operating system can impact all associated containers; conversely, a container breach can potentially invade the host operating system.

But what about the risks and vulnerabilities associated with the container image itself? A robust containerization strategy includes a “secure-by-default” approach, meaning that security should be inherent in the platform and not a separately deployed and configured solution. To this end, the container engine supports all the default isolation properties inherent in the underlying operating system. Security permissions can be defined to automatically block unwanted components from entering containers or to limit communications with unnecessary resources.

For example, Linux Namespaces helps to provide an isolated view of the system to each container; this includes networking, mount points, process IDs, user IDs, inter-process communication and hostname settings. Namespaces can limit access to any of those resources through processes within each container. Typically, subsystems that do not have Namespace support are not accessible from within a container. Administrators can easily create and manage these “isolation constraints” on each containerized application through a simple user interface.

Additionally, a wide range of container security solutions are available to automate threat detection and response across an enterprise. These tools help monitor and enforce security policies and meet industry standards to ensure the secure flow of data. For instance, security management software tools can help automate CI/CD pipelines, block vulnerabilities before production and investigate suspicious activity with real-time visibility. This approach falls under DevSecOps, the application and development process that automates the integration of security practices at every level of the software development lifecycle.

Related solutions
Red Hat® OpenShift on IBM Cloud

Red Hat OpenShift on IBM Cloud uses OpenShift in public and hybrid environments for velocity, market responsiveness, scalability and reliability.

Explore Red Hat OpenShift on IBM Cloud
IBM Cloud Satellite®

With IBM Cloud Satellite, you can launch consistent cloud services anywhere—on premises, at the edge and in public cloud environments.

Explore IBM Cloud Satellite
IBM Cloud Code Engine

Run container images, batch jobs or source code as serverless workloads—no sizing, deploying, networking or scaling required. 

Explore IBM Cloud Code Engine
Optimize Kubernetes with IBM Turbonomic®

Automatically determine the right resource allocation actions—and when to make them—to help ensure that your Kubernetes environments and mission-critical apps get exactly what they need to meet your SLOs.

Explore IBM Turbonomic
IBM Fusion

Fusion software runs anywhere Red Hat OpenShift runs—on public cloud, on-premises, bare metal and virtual machines. Fusion provides an easy way to deploy Red Hat OpenShift applications and IBM watsonx™.

Explore IBM Fusion
Resources Containers in the enterprise

IBM research documents the surging momentum of container and Kubernetes adoption.

What is Docker?

Docker is an open-source platform for building, deploying and managing containerized applications.

What are microservices?

In a microservices architecture, each application is composed of many smaller, loosely coupled and independently deployable services.

What are containers?

Containers are executable units of software that package application code along with its libraries and dependencies. They allow code to run in any computing environment, whether it be desktop, traditional IT or cloud infrastructure.

What is a virtual machine (VM)?

A virtual machine (VM) is a virtual representation or emulation of a physical computer that uses software instead of hardware to run programs and deploy applications.

What is Kubernetes?

Kubernetes, also known as k8s or kube, is an open-source container orchestration platform for scheduling and automating the deployment, management and scaling of containerized applications.

Take the next step

Red Hat OpenShift on IBM Cloud offers developers a fast and secure way to containerize and deploy enterprise workloads in Kubernetes clusters. Offload tedious and repetitive tasks involving security management, compliance management, deployment management and ongoing lifecycle management. 

Explore Red Hat OpenShift on IBM Cloud Start for free
Footnotes

All links reside outside ibm.com

The State of Cloud in the US, Forrester, June 14, 2022

Open Container Initiative

3 About Docker, Docker

4 Open Source Projects, Docker

5 Containers as a Service Market worth USD 5.6 billion by 2027 - Exclusive Study by MarketsandMarkets, Cision, 30 November 2022

6 State of Kubernetes Security Report, Red Hat, April 17, 2023