Docker 容器与虚拟机：架构、性能、配置和安全的比较研究
Docker Containers vs. Virtual Machines: A Comparative Study of Architecture, Performance, Configuration, and Security
浏览论文内容
中文总结 AI 辅助
该研究基于文献比较Docker容器与虚拟机在架构、性能、配置和安全性上的差异，指出容器高效但隔离弱，虚拟机开销大但隔离强，并建议混合架构作为云环境中的平衡方案。
中文摘要 AI 辅助
现代应用平台必须在保持部署速度、可移植性、资源效率和安全性同时隔离工作负载。虚拟机（VM）和 Docker 容器在不同抽象层满足这一要求：虚拟机虚拟化硬件并运行独立的客户操作系统，而容器在共享宿主内核的同时隔离进程。本文提出了一种基于文献的两种方法在架构、配置和生命周期管理、性能、可扩展性和安全性方面的比较分析。已发表的研究通常认为容器具有更短的启动时间、更小的镜像、更高的工作负载密度，以及许多工作负载的近原生执行。这些优势取决于工作负载特征、存储和网络驱动程序、资源控制以及实验设计。虚拟机引入更大的开销，但提供独立内核、异构客户操作系统和更强的隔离边界。因此，比较将效率和隔离视为设计权衡，而非宣称一种技术普遍优越。一种混合架构，即容器在加固虚拟机内运行，通常为云和多租户系统提供实用平衡。
英文摘要
Modern application platforms must isolate workloads while preserving deployment speed, portability, resource efficiency, and security. Virtual machines (VMs) and Docker containers address this requirement at different abstraction layers: VMs virtualize hardware and run independent guest operating systems, whereas containers isolate processes while sharing the host kernel. This paper presents a comparative, literature-based analysis of the two approaches across architecture, configuration and lifecycle management, performance, scalability, and security. Published studies generally associate containers with shorter startup times, smaller images, higher workload density, and near-native execution for many workloads. These benefits depend on workload characteristics, storage and network drivers, resource controls, and experimental design. VMs introduce greater overhead but offer independent kernels, heterogeneous guest operating systems, and a stronger isolation boundary. The comparison therefore treats efficiency and isolation as a design trade-off rather than declaring one technology universally superior. A hybrid architecture, in which containers run inside hardened VMs, often provides a practical balance for cloud and multi-tenant systems.
发表机构
- University of Michigan–Dearborn（密歇根大学迪尔伯恩分校）
机构由 AI 辅助整理，请以论文原文为准。
