[Autogenerated] There are cases where we want to run
applications in some kind of containerize environment that
has no effect on the host machine.
This is typically done using this isolation boundary known as a virtual machine.
And the very well company known as Vmware has created virtual
machine technology in 1998 and this works well.
We can run multiple virtual machines on the same host where each virtual
machine has no effect on other virtual machines or on the host.
And this is nice because it helps us to conserve physical resources.
So this works very well.
But every virtual machine is its own operating system and has its own resources,
needs to be managed and used,
which of course uh takes from the resources of the host.
And so there's obviously some kind of limit of the number of
virtual machines you can run on some physical host.
And if you can reduce that kind of resource usage,
that might be very beneficial.
And so the idea here is maybe there's another containerized way
to run applications that have no effect on other such entities
and have no effect on the host that might be beneficial if they
consume less resources.
And this is the idea of a container and perhaps there's some loss of security
there because we're talking about something which is more lightweight and
perhaps not as isolated as a full blown virtual machine,
but if you can't live with these potential deficiencies,
containers might be a better suit for what you're trying to do.
So the idea of a container is some kind of entity that can run
processes that have their own resources and all their dependencies
within the container and have no effect on other containers running
on the host or on the host itself.
So this is the same idea conceptually as a mutual machine but but
much less resources consumption being used,
which means you can run many more containers on the same host,
then you would be able to run virtual machines.
So this idea is great and this is where containers come into the play.
And so what we need here is the way to isolate processes running within this
container like entity and we need an actuated fine system.
So if a container goes to something like C temp,
it has its own private sea temp that has nothing to do
with another containers possible.
C temp or with the sea temp on the host.
We also need an isolated registry from the Windows perspective.
If any changes are being applied to the registry,
they shouldn't apply to registry views for other containers and
shouldn't really apply to the registry on the host.
Same goals for object namespaces we know that colonel objects can have names.
So if I create an object called abc that objects shouldn't be
mixed with an object that might have been named abc as well in
another container or in the host.
So only some kind of object namespace that is completely
isolated from other containers and the host.
If you can get these things,
then we have something to work with which has this nice
isolation and still is not consuming as much resources as
a full blown varchar machine.
Windows stand,
version 16 07 is the first one that provided that and this is
accomplished using this thing called the silo and the silo is
essentially a super job because the job already contains a
bunch of processes but it is, it is not a full blown sandbox.
A silo provides extra ways to to provide this kind of isolation
that we need and a sandbox sandbox of sorts.
And this required deep changes within executive components at that time
because if now we have a call to some function that tries to create an
object that has a name for instance abc then the executive has to ask
well where are you coming from from, which container are you?
And then provide the correct redirection to the correct object.
namespace same goals for five system operation and registry operations.
So deep things had to change at that time.
And silos as I mentioned are super jobs.
In fact every silo started its life as a job and then there's a
call to the set information job object that makes this job
upgrade to something called the silo which now has containment
capabilities as we'll soon see