Hacker News Reader

One thing that occurs to me: containers don't get their own network stacks, so you can't use a transport-level protocol (e.g. SCTP) in a Docker "guest" if it isn't programmed into the Docker host kernel. Whereas VMs are routed to at the network level, so they can do whatever they want with the packets they receive.

I meant to say that VMs can do a deeper level of process isolation. They also perform complete hardware virtualization, which means you can run a completely different OS inside the VM. However, in terms of performance, VMs are not necessarily faster than containers at all tasks.

The need for containers is more narrow in scope than simply the size of them, but that they allow very simple isolation on a file-system level. It allows a very strict separation of concerns without requiring the sacrifice of resources of spinning up another VM.