Docker
Docker is a tool for packaging an application together with everything it needs to run, its libraries, settings and system files, into an image that runs the same way on any machine. When you start an image you get a container: an ordinary process on the host, but one the Linux kernel fences off with namespaces (so it sees its own files, network and process list) and cgroups (so it can only use the CPU and memory it’s given). Unlike a virtual machine there’s no second operating system, so containers start in a second and are cheap. Images are built in layers, so a change to your code only rebuilds the top layer. It’s why “works on my machine” is less of an excuse than it used to be.
In this lesson: A 3D image-layer stack. Namespaces and cgroups as walls around a process.