RUNTIME EXECUTION ENVIRONMENTS

CONTAINERS AND VIRTUAL MACHINES Two common technologies create these isolated rooms. A virtual machine (VM) is a complete pretend computer, running in software on a real computer. It has its own operating system, which is the main control software of a computer, such as Windows or Linux. A virtual machine is like renting a separate apartment, with its own front door, kitchen, and plumbing. The isolation is strong, because the pretend computer is separated from the real one by a deep wall. The cost is that it is heavier: it takes more memory and longer to start. A container is a lighter package that holds a program and everything it needs, while sharing the underlying operating system of the host machine. If a virtual machine is a separate apartment, a container is a locked hotel room in a shared building. Containers start in a second or less and use little memory, which makes them popular, and a widely used tool for them is called Docker. The isolation is good but not quite as thick as a virtual machine, since containers share the host's operating system core. For this reason, when the code to be run is highly untrusted, engineers sometimes add extra protection, such as special secure container runtimes or tiny virtual machines that start very fast. Here is a plain comparison. Containers are faster and cheaper, with good isolation. Virtual machines are slower and heavier, with stronger isolation. Highly sensitive work often uses a virtual machine, or a container hardened with extra layers. A related trick is the snapshot. A snapshot is a saved picture of the full state of a virtual machine or container at one moment. Engineers can restore the snapshot before every new task so that every run begins from an identical clean state, with no leftover files from the last one. Many sandboxes are also disposable: they are created for one task and destroyed afterward.