The Docker image contains the packaged application and the environment it depends on (such as CPU, memory and other resources), it contains the file system and other metadata available to the…

Question

Options

• ATrue
• BFalse

• A
  26% (5)
• B
  74% (14)

Explanation

Option B (False) is correct because the statement makes two key errors. First, Docker images do not contain CPU, memory, or other hardware resources -- those are runtime constraints applied when a container is started, not packaged inside the image itself. Second, and more critically, Docker containers actually offer weaker isolation than traditional virtualization because containers share the host operating system's kernel, meaning a kernel vulnerability or a container escape exploit can compromise the entire host and all other containers running on it.

Virtualization technology (such as VMware or KVM) runs each virtual machine with its own guest OS and kernel, isolated from the host by a hypervisor. This hardware-level separation makes it significantly harder for a breach in one VM to affect others or the host, giving VMs a stronger security boundary than containers.

Option A (True) is wrong because it accepts both factual errors in the statement without questioning them.

Memory tip: Remember "containers share the kernel, VMs own their kernel." Shared infrastructure always means a shared attack surface, so VMs win on isolation security despite being heavier and slower than containers.

No community discussion yet for this question.