Build the idea first, then use the next activity to check it.
Virtual machines, containers and VRFs
Three kinds of "several things sharing one thing", and what each one actually isolates.
What you will be able to do
- Distinguish a virtual machine from a container by what each one includes
- Explain what a hypervisor does and where a virtual switch fits
- Describe what a VRF separates and how it differs from a VLAN
- Say which layer each form of isolation operates at
Before this: You need VLANs and broadcast domains from "Broadcast domains and VLANs", and the routing table from "How a router chooses a path".
Why it matters: Almost every server you meet is virtual and almost every network device is carrying traffic for more than one logical network. Both exams test the vocabulary, and the useful organising question - what exactly is being kept apart - also happens to be the one that matters when something leaks.
Virtualisation is one idea applied at several layers: let one physical thing behave as several independent ones. What changes between the forms is where the dividing line is drawn, and therefore what is genuinely separated and what is quietly shared.
Server virtualisation
A hypervisor presents virtual hardware to each guest, so several complete operating systems run on one physical machine. Each guest believes it has its own processor, memory, disk and network card, and none of them is aware of the others.
| Type | Runs on | Typical use |
|---|---|---|
| Type 1, bare metal | Directly on the hardware | Servers - nothing between the hypervisor and the machine |
| Type 2, hosted | On top of an ordinary operating system | Desktops and labs - convenient rather than efficient |
Because each guest has a virtual network card, the host needs something for those cards to plug into. That is a virtual switch, and it behaves like a physical one: it learns MAC addresses, it can carry VLANs, and it can trunk to the physical network.
Containers
A container shares the host's kernel rather than virtualising hardware. It packages an application and its dependencies, and the isolation comes from kernel features that give it its own view of the filesystem, the process list and the network - not from emulated hardware.
| Property | Virtual machine | Container |
|---|---|---|
| Includes an operating system kernel | Yes, its own | No, shares the host's |
| Startup time | Seconds to minutes | Well under a second |
| Size | Gigabytes | Megabytes |
| Isolation strength | Stronger - a separate kernel | Weaker - a shared kernel is a shared surface |
| Can run a different OS kernel | Yes | No |
Neither is better in general. A container starts faster and costs less because it leaves out the operating system; a virtual machine isolates more thoroughly for exactly the same reason. Which trade you want depends on whether the things sharing the host trust each other.
What this platform is
The labs you have been running are containers. Each node is a process with its own network namespace, joined to the others by virtual interface pairs. That is why a lab starts in seconds - and it is also why there is no physical layer to fault, no duplex to mismatch and no wireless to configure, because none of that is emulated.
VRFs
A VLAN divides one switch into several broadcast domains. A VRF - a virtual routing and forwarding instance - does the equivalent one layer up: it divides one router into several independent routing tables.
Each VRF has its own table, its own interfaces and its own routes. Traffic does not move between them unless something is explicitly configured to leak routes across, so two VRFs can carry overlapping address space on one device without conflict.
| Mechanism | Divides | Layer | Two of them can share an address range |
|---|---|---|---|
| VLAN | One switch into several broadcast domains | 2 | No - they are separate domains, not separate tables |
| VRF | One router into several routing tables | 3 | Yes |
| Virtual machine | One physical server into several complete machines | Below all of it | Yes |
What is still shared
Every form of virtualisation shares something, and knowing what is the practical skill here.
- Virtual machines share the physical host - its memory bandwidth, its network cards, and its failure.
- Containers additionally share the kernel, so a kernel-level compromise is not contained by them.
- VRFs share the router - its processor, and any bug in the code that keeps the tables apart.
- All of them share the physical link out, however separated they look in the configuration.
This is why "these are separated" needs a follow-up question about what the separation is made of. Logical isolation is real and useful, and it is not the same as two devices with no cable between them.
Terminology
- Hypervisor
- Software presenting virtual hardware to guest operating systems. Type 1 runs on the hardware, type 2 on a host OS.
- Virtual switch
- A software switch inside a host, connecting guest network interfaces to each other and to the physical network.
- Container
- An isolated application environment sharing the host kernel rather than virtualising hardware.
- VRF
- Virtual routing and forwarding - an independent routing table on a shared router, allowing overlapping address space.
Key takeaways
- A virtual machine brings its own kernel; a container shares the host's.
- Containers start faster and isolate less, for the same underlying reason.
- Traffic between guests on one virtual switch may never touch the physical network.
- A VRF divides a router into independent routing tables, as a VLAN divides a switch into broadcast domains.
- Two VRFs may carry overlapping address space; two VLANs on one switch may not.
- Every form of virtualisation shares something - ask what, before calling it isolated.
Ready to keep going?
Create a free account to save your progress and take the knowledge check.