Show what a shared kernel shares

short · 35 min · Objective 3.1

Task

Compare what a container and a virtual machine can each see of their host, and put a concrete observation behind the claim that one isolates a process and the other isolates an operating system.

Steps

  1. From the host, record the kernel version and the number of processes: uname -r and ps -e --no-headers | wc -l.
  2. Start a container from a minimal image and, inside it, run uname -r and ps -e --no-headers | wc -l. Record both.
  3. Compare the kernel versions. They are identical, and they are identical because there is only one kernel — that single fact is what the whole isolation argument turns on.
  4. Now compare the process counts and explain the difference: the container sees fewer processes because of a namespace, not because the others are on a different machine.
  5. From inside the container, look at /proc/cpuinfo and the host's memory total. Note how much of the host's hardware is visible.
  6. Write /tmp/isolation-compare.md stating which of the two — container or VM — you would use to separate two workloads of very different sensitivity, and why the shared kernel decides it.

Verify

uname -r
sudo docker run --rm alpine uname -r 2>/dev/null || sudo podman run --rm alpine uname -r
python3 - <<'PY'
import subprocess
def run(c): return subprocess.run(c,shell=True,capture_output=True,text=True).stdout.strip()
host=run('uname -r')
cont=run('sudo docker run --rm alpine uname -r 2>/dev/null || sudo podman run --rm alpine uname -r')
print('host kernel  :',host)
print('container    :',cont)
assert host==cont, 'kernels differ - that is a VM, not a container'
print('same kernel: the container shares the host failure domain')
PY
grep -icE "shared kernel|failure domain|hypervisor" /tmp/isolation-compare.md

The assertion is the lab: the kernel strings must match, which proves the container is not running its own operating system. If they differ, you have started a VM by accident, and the comparison the lab is making has not been made.

Notes

This is why the lesson says a shared kernel is a shared failure domain. A kernel vulnerability inside the container is a kernel vulnerability on the host, and no amount of container configuration changes that — which is why workloads of very different sensitivity want separate hosts rather than separate containers.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.