Definition
Plain language
A program packed up with everything it needs and fenced off from the rest of the computer.
As stated in the literature
An isolated process group on a shared kernel, separated by namespaces and cgroups; isolation strength depends on the granted capabilities, mounts, and seccomp policy rather than on hardware boundaries.
Also called: containers, containerized
Why it matters: Containers are how most modern software gets shipped and run, but the fence around them is a software convention rather than a wall, so a sloppily configured one offers far less protection than people assume.
For example, a web app, its libraries, and its configuration can be shipped as one container that runs identically on a developer's laptop and on a rented cloud server.
Heard on the show
“Real SSH connections into Docker containers.”Episode 001 — When AI Models Quietly Protect Each Other From Shutdown