Container engines can run multiple, isolated instances, known as containers, on the same operating system kernel. Containers perform virtualization at the operating system level, and provide a controllable, easily manageable environment for running applications and dependencies. Container isolation can also enhance security by separating programs, applications and code from other applications running on the same physical host.
Most modern container engines use the Open Container Initiative (OCI) container image format. OCI container images are a representation of a container and the software that should run within it, making it possible to create new containers in a predictable, repeatable way.
A key component of a container engine is the container runtime, which communicates with the operating system kernel to perform the containerization process and configure access and security policies for running containers.