[Windows Containers] 4: Understanding Base Images and Isolation Methods

To operate Windows containers stably, it is essential to select a base image suited to the purpose and determine an appropriate isolation method.

The main base images include Server Core and Nano Server. Server Core ensures high compatibility but tends to have a larger image size, while Nano Server includes only core functionality, resulting in a smaller size and optimization for running specific applications such as Python, Go, and .NET Core. In addition, various special-purpose images are provided, including Windows, IoT, ML, and IIS.

Isolation methods are broadly divided into two types.

• Process isolation method: Separates resources through kernel namespaces, offering excellent performance and advantages for hardware integration. However, the OS version of the container image and the host OS version must match.
• Hyper-V isolation method: Uses virtualization technology to build a kernel environment separated from the host. It offers high security but uses more memory, and the image version must be lower than or equal to the host version, requiring virtualization support on the host.