Windows Server Containers and Virtualization

Overview: Containers vs. Virtual Machines

  • Container Concept: An isolated, lightweight package designed to run an application and its complete set of dependencies, libraries, and configurations.

  • Virtual Machines (VMs): Rely on a hypervisor positioned directly above the hardware to virtualize hardware controllers and run an entire guest operating system.

  • Containers Architecture: Operate by adding a container engine layer directly on top of the host operating system, sharing the host OS resources rather than virtualizing physical hardware.

  • Key Benefits: Much smaller in size and more portable than virtual machines; run consistently across diverse operating systems (Windows, Linux) and cloud environments such as Azure.

Container Isolation Modes in Windows Server

  • Windows Server Containers (Process Isolation):

    • Isolates applications within sandboxed environments on the host operating system.

    • Shares the host operating system kernel and system resources.

  • Hyper-V Containers (Hyper-V Isolation):

    • Runs each container within a specialized, lightweight virtual machine with its own isolated copy of the operating system kernel.

    • Prevents container access to the host operating system, mitigating risks of malicious container breakouts.

    • Provides enhanced security at the cost of higher hardware resource utilization.

    • Requires both the Containers feature and the Hyper-V role installed on the host.

Installation and Configuration Requirements

  • Docker Platform: Microsoft uses Docker, an open-source container engine, to deploy and manage containers on Windows hosts.

  • Setup Procedure:

    • Containers feature must be installed via Server Manager or PowerShell.

    • Docker is installed and configured via PowerShell or manual installation.

    • Microsoft provides a specialized PowerShell module capable of enabling the Containers feature and configuring Docker using two PowerShell commands.

  • OS Version Matching: The host operating system version must match the container operating system version (e.g., Server 2022 hosts require a Windows Server 2022 base image; running older images such as Server 2016 requires a VM matching that version).

  • Base Image Composition: Built from two files: the release to manufacture image (initial OS version) and the patch and update image (all subsequent operating system updates).

Windows Server Base Image Options

  • Nano Server: The smallest container image footprint; supports only modern applications using .NET Core.

  • Server Core: A larger base image; provides support for legacy applications and the .NET Framework.

  • Windows Server: Full base image; contains almost all Windows Server components, including Desktop Experience features.

  • Interface Limitation: No container base images include a graphical user interface (GUI) to keep image sizes minimal.

Networking and Container Orchestration

  • Network Interfaces: Each container is assigned an individual virtual network adapter.

  • Docker Networking Modes:

    • NAT Mode: Default network created upon initial launch; maps container traffic to an internal virtual switch (vSwitch).

    • Transparent Mode: Connects container traffic directly to an external virtual switch (vSwitch).

  • Container Orchestration:

    • Manages, automates, and scales multiple containers simultaneously.

    • Tools include Docker Swarm and Kubernetes.

    • Microsoft transitions from Docker Swarm to Kubernetes in Server 2022, establishing Kubernetes as the standard management platform.