-->![Docker/for Docker/for](https://avatars1.githubusercontent.com/u/6760334?s=88&v=4)
Oct 28, 2016 Why is Docker so slow on Mac? So we just started working in our team with Docker, and some people in our group has Macs, others have Linux. Our app runs much faster on. Mark the issue as fresh with /remove-lifecycle stale comment. Stale issues will be closed after an additional 30d of inactivity. Prevent issues from auto-closing with an /lifecycle frozen comment. If this issue is safe to close now please do so. Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
Windows containers offer two distinct modes of runtime isolation:
process
and Hyper-V
isolation. Containers running under both isolation modes are created, managed, and function identically. They also produce and consume the same container images. The difference between the isolation modes is to what degree of isolation is created between the container, the host operating system, and all of the other containers running on that host.Process Isolation
This is the 'traditional' isolation mode for containers and is what is described in the Windows containers overview. With process isolation, multiple container instances run concurrently on a given host with isolation provided through namespace, resource control, and process isolation technologies. When running in this mode, containers share the same kernel with the host as well as each other. This is approximately the same as how Linux containers run.
Hyper-V isolation
This isolation mode offers enhanced security and broader compatibility between host and container versions. With Hyper-V isolation, multiple container instances run concurrently on a host; However, each container runs inside of a highly optimized virtual machine and effectively gets its own kernel. The presence of the virtual machine provides hardware-level isolation between each container as well as the container host.
Isolation examples
Create container
Managing Hyper-V-isolated containers with Docker is nearly identical to managing process-isolated containers. To create a container with Hyper-V isolation thorough Docker, use the
--isolation
parameter to set --isolation=hyperv
.To create a container with process isolation thorough Docker, use the
--isolation
parameter to set --isolation=process
.Windows containers running on Windows Server default to running with process isolation. Windows containers running on Windows 10 Pro and Enterprise default to running with Hyper-V isolation. Starting with the Windows 10 October 2018 update, users running a Windows 10 Pro or Enterprise host can run a Windows container with process isolation. Users must must directly request process isolation by using the
--isolation=process
flag.Warning
Running with process isolation on Windows 10 Pro and Enterprise is meant for development/testing. Your host must be running Windows 10 build 17763+ and you must have a Docker version with Engine 18.09 or newer.
You should continue to use Windows Server as the host for production deployments. By using this feature on Windows 10 Pro and Enterprise, you must also ensure that your host and container version tags match, otherwise the container may fail to start or exhibit undefined behavior.
Isolation explanation
This example demonstrates the differences in isolation capabilities between process and Hyper-V isolation.
Here, a process-isolated container is being deployed and will be hosting a long-running ping process.
Using the
docker top
command, the ping process is returned as seen inside the container. The process in this example has an ID of 3964.On the container host, the
get-process
command can be used to return any running ping processes from the host. In this example there is one, and the process id matches that from the container. It is the same process visible from both container and host.To contrast, this example starts a Hyper-V -solated container with a ping process as well.
Likewise,
docker top
can be used to return the running processes from the container.However, when searching for the process on the container host, a ping process is not found and an error is thrown.
Finally, on the host, the
vmwp
process is visible, which is the running virtual machine that is encapsulating the running container and protecting the running processes from the host operating system.