# OCI Container A container is an application packaged with its complete dependency tree into an immutable image, run as an isolated process on a shared operating system kernel. Standardized through an open initiative, the image and runtime formats let software built anywhere run identically anywhere, which is the property every layer of cluster operations above it depends on. > [!note] The one-sentence version > Ship the application with everything it needs in one immutable layered image, and run it as an ordinary isolated process rather than a whole virtual machine. ## How the isolation works Containers are not small virtual machines; they are ordinary processes with restricted views, which is why they start in milliseconds and cost almost nothing in overhead. The kernel provides the mechanisms. **Namespaces** give a process its own view of the process table, the filesystem mount tree, the network stack, user identifiers, and hostname, so it sees a world containing only itself. **Control groups** limit and account for its processor, memory, and input-output consumption, which is what makes shared machines predictable and what cluster schedulers program when they allocate resources. **Capabilities, seccomp filters, and mandatory access control** narrow what the process may ask the kernel to do. Together these produce isolation that is strong, cheap, and weaker than a hypervisor's, which is the trade being made; where tenant separation must be stronger, virtual machines or hardware isolation are used instead; see [[wiki/Confidential Computing|Confidential Computing]]. ## Prerequisites - **Image and layers:** a stack of filesystem layers, each content-addressed by cryptographic digest, assembled into a root filesystem; shared layers are stored and transferred once. - **Registry:** the service images are pushed to and pulled from, commonly backed by object storage; see [[wiki/S3-Compatible Object Storage|S3-Compatible Object Storage]]. - **Digest and tag:** an immutable content hash, against a mutable human-readable label; production practice pins digests, because a tag can be moved and a digest cannot. - **Runtime:** the component that unpacks an image and starts the process under the kernel's isolation mechanisms, to a standardized specification so that several implementations interoperate. - **Image signing and provenance:** cryptographic attestation of who built an image and from what, now standard practice in serious supply chains; see [[wiki/Supply Chain Security|Supply Chain Security]]. ## Why accelerator containers are harder A container ordinarily carries all its dependencies, but an accelerator requires a kernel driver on the host, and the user-space libraries inside the image must be compatible with it. The result is a coupling a container was designed to avoid: images are built against driver generations, hosts must be kept within a compatible range, and a cluster upgrade becomes a coordinated matter between host drivers and the images running on them. Device plugins expose accelerators to the runtime, and the container must be granted the specific devices and, for the fabric, the specific interfaces it needs; see [[wiki/Kubernetes|Kubernetes]]. The images themselves are also unusually large, often many gigabytes of framework and library code, which makes registry bandwidth and local image caching a real operational concern when a thousand nodes start the same job at once. ## Relationships - **orchestrated by:** [[wiki/Kubernetes|Kubernetes]] · [[wiki/Slurm|Slurm]] · [[wiki/Job Scheduling|Job Scheduling]] - **packages:** [[wiki/PyTorch|PyTorch]] · [[wiki/vLLM|vLLM]] · [[wiki/CUDA|CUDA]] · [[wiki/ROCm|ROCm]] - **stored in:** [[wiki/S3-Compatible Object Storage|S3-Compatible Object Storage]] - **secured through:** [[wiki/Supply Chain Security|Supply Chain Security]] · [[wiki/Confidential Computing|Confidential Computing]] - **part of:** [[wiki/Software and Orchestration|Software and Orchestration]] - **source articles:** [[articles/Vertically Integrating an AI Superpower from AI Factory to Citizen|Vertically Integrating an AI Superpower from AI Factory to Citizen]] · [[articles/The Gigawatt Is the New Measure of War|The Gigawatt Is the New Measure of War]] - **collection route:** [[collections/American Infrastructure|American Infrastructure]] · [[collections/American|American Collection]] ## Evidence posture - **Established:** namespaces, control groups, capabilities, seccomp, and mandatory access control as the kernel mechanisms of container isolation; content-addressed layered images with shared layer storage; registries, digests, and tags with digest pinning as production practice; standardized image and runtime specifications with multiple interoperating implementations; image signing and build provenance. - **Established:** host driver and in-image library coupling for accelerator containers, device plugin exposure of accelerators and fabric interfaces, multi-gigabyte image sizes, and registry bandwidth and local caching as operational concerns at cluster scale. - **Established:** container isolation as weaker than hypervisor isolation, with virtual machines or hardware isolation used where tenant separation must be stronger. ## Sources - Open Container Initiative specifications and container runtime practice, as current October 2026.