Operating Systems, Virtualization and Containers

Introduction

An operating system (OS) is the foundational software layer that manages computer hardware and provides controlled services to application programs. In an enterprise, the OS is not merely a technical utility. It affects availability, cybersecurity, performance, compliance, cost, and the ability to deploy business applications consistently. Virtualization and container technologies extend the OS concept by allowing several logical computing environments to share physical infrastructure.

Virtual machines (VMs) emulate complete computers, including virtual processors, memory, storage, and network interfaces. Containers provide isolated user-space environments that generally share the host operating system kernel. These approaches support server consolidation, cloud computing, disaster recovery, software testing, and scalable digital services. However, they differ substantially in isolation, performance, portability, operational complexity, and security.

This chapter develops the operating-system functions relevant to managerial and technical decision-making, explains resource management and OS security, and evaluates VMs, hypervisors, and containers for enterprise deployment.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the principal functions and components of an operating system.
2. Analyse how an OS manages processors, memory, storage, devices, and processes.
3. Evaluate operating-system security controls and governance responsibilities.
4. Explain the architecture and operation of virtual machines and hypervisors.
5. Distinguish VMs from containers and select an appropriate deployment model.
6. Assess virtualization and containerization using performance, risk, cost, and operational criteria.

1. The Operating System as a Resource and Control Layer

A computer system contains hardware resources, system software, application software, data, and users. The OS mediates between applications and hardware. It performs two related roles:

• Resource manager: allocates scarce resources such as CPU time, main memory, disk space, and network capacity.
• Control program: enforces rules concerning access, isolation, reliability, and communication.

Without an OS, each application would need to control hardware directly. Such an arrangement would be difficult to program, insecure, and prone to conflicts. The OS instead exposes abstractions such as files, processes, sockets, virtual memory, and device interfaces.

A typical system is organized into layers:

1. Hardware: processors, memory, storage, network interfaces, and peripheral devices.
2. Firmware: low-level software that initializes hardware and supports booting.
3. Kernel: the privileged core of the OS.
4. System services and libraries: reusable facilities for networking, authentication, logging, and other functions.
5. User interface and administration tools: command-line interfaces, graphical interfaces, and management consoles.
6. Applications: business and end-user programs.

The kernel runs in privileged mode and can execute protected instructions. Applications usually run in user mode, where their access to hardware and memory is restricted. A controlled transition from user mode to kernel mode occurs through a system call. For example, an application may request that the OS open a file, create a process, or send data through a network connection.

2. Core Operating-System Functions

2.1 Process and Thread Management

A process is a running instance of a program together with its address space, registers, open files, and operating-system control information. A thread is an execution path within a process. Multiple threads can share the process's memory and resources while executing concurrently.

The OS creates and terminates processes, assigns CPU time, changes process states, and coordinates communication. Common process states include new, ready, running, blocked, and terminated. A process becomes blocked when it must wait for an event such as completion of disk input or arrival of network data.

The scheduler determines which ready process or thread receives processor time. Scheduling objectives may include:

• high processor utilization;
• high throughput;
• low response time;
• predictable service levels;
• fairness among workloads; and
• priority for critical applications.

In an enterprise, scheduling policy should reflect business priorities. A transaction-processing system may prioritize response time, whereas a batch analytics platform may prioritize throughput.

2.2 Memory Management

The OS allocates memory to processes and prevents one process from improperly reading or modifying another. Modern operating systems commonly use virtual memory, in which each process receives a logical address space that is mapped to physical memory. Parts of a process may temporarily be stored on disk when physical memory is insufficient.

Virtual memory provides isolation and permits programs to use an address space larger than available physical memory. Its performance depends on sufficient physical memory and efficient address translation. Excessive movement of pages between memory and storage, called thrashing, can cause severe performance degradation.

Memory protection is especially important in multi-user and virtualized systems. A failure in one application should normally result in termination of that application rather than corruption of the kernel or other applications.

2.3 File and Storage Management

The OS organizes persistent data through file systems. A file system provides naming, directories, metadata, permissions, allocation of storage blocks, and recovery mechanisms. Metadata may include file size, owner, timestamps, and access rights.

Storage management involves:

• allocating and releasing storage space;
• maintaining directory structures;
• buffering and caching data;
• detecting or recovering from errors;
• controlling permissions; and
• supporting backup and restoration.

Enterprise decisions must distinguish capacity from performance. A storage system may have adequate capacity but insufficient input/output operations per second (IOPS) or excessive latency. Database, virtualization, and analytics workloads are particularly sensitive to storage performance.

2.4 Device and Input/Output Management

Applications normally use device-independent interfaces rather than directly controlling hardware. Device drivers translate OS requests into device-specific commands. The OS manages interrupts, buffering, caching, queues, and access permissions.

Input/output operations are often slower than CPU operations. Consequently, the OS may allow a process to continue while an I/O request is being completed. Effective I/O management improves utilization but introduces coordination and failure-handling requirements.

2.5 Networking and Interprocess Communication

Operating systems provide networking stacks, socket interfaces, routing support, name resolution, and firewall facilities. They also support interprocess communication through mechanisms such as pipes, shared memory, signals, message queues, and local sockets.

These services allow distributed business applications to exchange information while preserving controlled boundaries. Network configuration is therefore part of both system performance and security management.

2.6 User, Account, and Service Management

The OS maintains users, groups, service accounts, authentication mechanisms, and authorization policies. It also records events such as logins, privilege changes, process failures, and security violations. These records support troubleshooting, compliance, and forensic investigation.

3. Resource Management and Performance

Resource management is a balancing problem. Physical resources are finite, while demand varies over time. The OS uses allocation, scheduling, isolation, and monitoring to convert hardware capacity into useful service.

Important performance measures include:

A simplified utilization measure is:

where U is utilization, B is the time a resource is busy, and T is the observation period. Both B and T must use the same time unit, and 0 ≤ U ≤ 1. The expression describes activity, not necessarily good performance: a CPU at 100% utilization may indicate efficiency or harmful saturation.

Capacity planning should examine peak demand, workload variability, dependencies, and service-level agreements. Adding processors may not solve a storage bottleneck; adding memory may not resolve network congestion. Managers should therefore evaluate the complete service path rather than a single metric.

4. Operating-System Security

OS security seeks to preserve confidentiality, integrity, and availability. These objectives are supported by a combination of technical controls, administrative policies, and monitoring.

4.1 Identity and Access Control

Authentication verifies identity; authorization determines permitted actions; accounting or auditing records activity. Effective access control follows least privilege, granting users and services only the rights necessary for assigned tasks.

Common controls include:

• strong authentication and, where appropriate, multifactor authentication;
• role-based access control;
• separation of administrative duties;
• controlled use of privileged accounts;
• timely removal of inactive accounts; and
• periodic access reviews.

4.2 Hardening and Patch Management

Hardening reduces the attack surface by disabling unnecessary services, removing unused software, restricting administrative interfaces, applying secure configuration baselines, and protecting management channels. Patch management identifies, tests, prioritizes, deploys, and verifies security updates.

Patching involves a trade-off. Delayed patches increase exposure, but untested patches may disrupt essential systems. Risk-based prioritization should consider vulnerability severity, exploit availability, business criticality, exposure, and the existence of compensating controls.

4.3 Isolation, Encryption, and Monitoring

Process isolation, file permissions, network segmentation, and sandboxing limit the impact of compromise. Encryption protects data in transit and, where appropriate, at rest. Encryption does not eliminate the need for access control because authorized users and compromised credentials may still access decrypted data.

Logs should be protected against unauthorized alteration and should contain sufficient time, identity, event, and system context. Security monitoring may identify unusual logins, privilege escalation, unexpected processes, or abnormal network behavior.

4.4 Governance and Risk

Virtualized and containerized environments create shared-responsibility questions. The infrastructure provider may secure the physical host and virtualization layer, while the customer remains responsible for guest OS configuration, identities, application security, and data governance. Responsibilities must be documented in contracts, operating procedures, and control frameworks.

Security design should also address data residency, retention, auditability, incident response, software licensing, and regulatory requirements. A technically efficient deployment can still be unacceptable if it violates privacy or sector-specific obligations.

5. Virtualization and Virtual Machines

Virtualization is the abstraction of physical computing resources into logical resources that can be allocated independently of the underlying hardware. A virtual machine is a software-defined computer that presents virtual hardware to a guest operating system.

A VM commonly includes virtual CPUs, virtual memory, virtual disks, a virtual network interface, firmware, and device models. The guest OS operates as though it owns a computer, although privileged operations are mediated by the virtualization layer.

VMs provide:

• isolation between workloads;
• improved hardware utilization;
• rapid provisioning and cloning;
• snapshots and rollback capabilities;
• support for different guest operating systems on one host; and
• portability across compatible infrastructure.

A snapshot is useful for short-term testing or recovery from a controlled change, but it is not a complete substitute for independent backup. Long-lived snapshots can consume storage and complicate performance and recovery management.

Hypervisors

A hypervisor, also called a virtual machine monitor, creates and manages VMs. It allocates physical resources, intercepts or mediates privileged operations, provides virtual devices, and enforces isolation.

Modern processors provide hardware-assisted virtualization features that improve the efficiency of executing guest instructions and managing memory. Nevertheless, virtualization introduces overhead from CPU scheduling, memory translation, virtual I/O, and management layers.

Figure: VMs include a guest operating system for each virtual machine, while containers generally share the host kernel.

VM Resource Allocation

A hypervisor may assign virtual CPUs, memory, storage, and network bandwidth to each VM. Overcommitment occurs when the configured virtual resources exceed physical capacity on the assumption that not all workloads peak simultaneously. Overcommitment can improve utilization but increases contention risk and complicates performance prediction.

For example, a server with 16 physical cores may host VMs configured with a total of 24 virtual CPUs. This configuration is not automatically wrong; its suitability depends on workload concurrency, scheduling overhead, service-level requirements, and observed contention. Capacity decisions should be validated through monitoring and load testing rather than configuration totals alone.

6. Containers

A container packages an application and its dependencies into an isolated user-space environment. Unlike a conventional VM, a container generally does not contain a complete guest kernel. Containers share the host kernel while using OS mechanisms such as namespaces for isolation and control groups for resource limits.

Containers are usually lightweight and start quickly because they avoid booting a separate guest OS. They support reproducible packaging, continuous integration, microservices, automated scaling, and immutable deployment patterns.

Container images are normally built from layered filesystems. Layers can be reused, reducing transfer and storage requirements. However, image layers may contain vulnerable or unnecessary components. Images should therefore be scanned, minimized, signed where appropriate, and obtained from controlled registries.

Containers are not simply “small VMs.” Their shared-kernel model creates a different security boundary. A kernel vulnerability or runtime misconfiguration may affect multiple containers. Container isolation can be strengthened through non-root execution, capability restrictions, read-only filesystems, mandatory access controls, network policies, secret management, and regular host patching.

7. VMs and Containers: Enterprise Evaluation

The choice should be based on workload characteristics rather than fashion. VMs may be preferable where regulatory isolation, legacy operating systems, kernel independence, or strong administrative boundaries are important. Containers may be preferable where rapid scaling, deployment consistency, and high workload density are priorities.

Containers are frequently deployed through an orchestration platform. Orchestration automates scheduling, service discovery, scaling, health checks, rolling updates, and replacement of failed instances. It does not remove the need for architecture, security, monitoring, and governance. A complex orchestration platform may create substantial operational demands for a small organization.

8. Applied Case: A Retailer Modernizes Its Order Platform

Background

Illustrative case: Meridian Retail operates an online ordering platform, a warehouse system, and several older financial applications. Its physical data center contains underused servers, while peak holiday demand causes slow response times.

Problem

The retailer wants to reduce infrastructure cost and improve deployment speed. It must preserve the reliability of financial applications, protect customer data, and scale online ordering during seasonal peaks.

Analysis

The financial applications run on an older operating system and require carefully controlled changes. Rewriting them would be expensive and risky. The online ordering platform consists of independently deployable services, including catalog, payment coordination, inventory, and notification functions. These services experience uneven demand.

Approach and Solution

Meridian places the legacy financial systems in VMs on a Type 1 hypervisor cluster. This approach preserves guest-OS compatibility, enables controlled snapshots for testing, and improves hardware utilization. The retailer deploys new ordering services as containers, using resource limits, signed images, vulnerability scanning, centralized logging, network policies, and automated health checks.

Customer databases are not placed in containers merely for convenience. They use a managed, replicated database service with defined backup and recovery objectives. The platform team separates development, testing, and production access and uses infrastructure-as-code to make approved configurations repeatable.

Outcome

The retailer gains faster release cycles for the order platform and more consistent utilization of its servers. Legacy applications remain isolated and stable. During seasonal peaks, containerized services scale horizontally, while VM resources are reserved for systems with predictable capacity requirements.

Learning Points

1. One organization may rationally use both VMs and containers.
2. Deployment technology should follow workload and risk characteristics.
3. Scaling the application tier does not automatically scale databases or external dependencies.
4. Security controls must cover images, hosts, identities, networks, logs, and data.
5. Business continuity requires tested backups and recovery procedures, not only snapshots or replicas.

9. Limitations, Risks, and Best Practices

Virtualization can create concentration risk: a failure in a physical host, hypervisor cluster, or shared storage system may affect many workloads. VM sprawl can increase licensing, patching, and monitoring costs. Resource overcommitment can produce unpredictable performance.

Containers can encourage rapid deployment without adequate governance. Common risks include vulnerable images, exposed management interfaces, excessive privileges, secrets embedded in images, weak network segmentation, and unpatched host kernels. Short-lived containers can also make forensic investigation more difficult unless logs and audit data are centralized.

Recommended practices include:

• maintain an inventory of hosts, VMs, images, containers, owners, and dependencies;
• use approved hardened OS and image baselines;
• apply least privilege and avoid unnecessary root access;
• patch hypervisors, host kernels, guest operating systems, runtimes, and images;
• separate management, production, test, and development networks;
• define CPU, memory, storage, and network resource limits;
• monitor saturation, latency, errors, and availability rather than utilization alone;
• test backup restoration and disaster recovery;
• use vulnerability scanning and software-component inventories;
• protect secrets through dedicated secret-management systems;
• document shared-responsibility boundaries; and
• perform controlled change management and post-incident review.

Artificial intelligence may assist with anomaly detection, capacity forecasting, log analysis, and automated remediation. Such systems should remain subject to human oversight because inaccurate alerts or automated changes can interrupt critical services. AI workloads also require consideration of accelerator allocation, data confidentiality, model dependencies, and reproducibility.

Chapter Summary

Operating systems manage hardware resources and provide secure abstractions for applications. Their principal responsibilities include process scheduling, memory protection, file and storage management, device and I/O control, networking, user management, and auditing. Performance must be assessed through utilization, throughput, response time, latency, and availability in relation to business requirements.

OS security depends on authentication, authorization, least privilege, hardening, patch management, isolation, encryption, logging, and governance. Virtualization abstracts physical resources into VMs managed by hypervisors. VMs provide strong workload separation and can run different guest operating systems, but they require more resources and administrative maintenance. Containers package applications and dependencies while generally sharing a host kernel. They start quickly and support scalable delivery, but their shared-kernel boundary requires careful security controls.

Enterprise deployment decisions should consider workload architecture, performance, isolation, compliance, operational capability, cost, resilience, and recovery. VMs and containers are complementary technologies rather than mutually exclusive alternatives.

Key Terms

Operating system: Software that manages hardware and provides services to applications.

Kernel: The privileged core of an operating system.

Process: A running program with its own execution and resource context.

Thread: An execution path within a process.

Virtual memory: A mechanism that maps logical process addresses to physical memory and storage.

File system: A structure and set of rules for naming, storing, and protecting files.

System call: A controlled request from an application to the operating system.

Least privilege: Granting only the access required for an authorized task.

Hardening: Reducing exposure by applying secure configurations and removing unnecessary functions.

Virtualization: Abstraction of physical computing resources into logical resources.

Virtual machine: A software-defined computer that runs a guest operating system.

Hypervisor: Software that creates and manages virtual machines.

Type 1 hypervisor: A hypervisor that runs directly on physical hardware.

Type 2 hypervisor: A hypervisor that runs as an application on a host OS.

Container: An isolated user-space environment that generally shares the host kernel.

Container image: A packaged, layered representation of an application and its dependencies.

Orchestration: Automated management of container deployment, scaling, networking, and recovery.

Overcommitment: Assigning more virtual resources than physically exist based on expected demand patterns.

Availability: The extent to which a service is operational when required.

Shared responsibility: Division of security and management duties between provider and customer.

Review Questions

Short Answer Questions

1. What are the two principal roles of an operating system?
2. Distinguish a process from a thread.
3. What is the purpose of a hypervisor?
4. Why do containers generally start faster than VMs?
5. Define least privilege.

Long Answer Questions

1. Explain how an operating system manages CPU, memory, storage, and I/O resources.
2. Discuss the relationship between authentication, authorization, accounting, and least privilege.
3. Explain the architecture of a VM and compare Type 1 and Type 2 hypervisors.
4. Evaluate the security advantages and limitations of containers.
5. Discuss the factors an enterprise should consider when selecting VMs, containers, or both.

Analytical / Application Questions

1. A company has legacy applications requiring different operating systems and new microservices requiring rapid scaling. Recommend a deployment architecture and justify it using technical and managerial criteria.
2. A virtualized server shows high CPU utilization, slow storage response, and increased application latency. Develop a structured diagnostic approach rather than assuming that adding CPUs will solve the problem.
3. Design a governance checklist for a container platform covering image security, identity, host protection, network controls, monitoring, compliance, and disaster recovery.

Multiple Choice Questions with Answers

Question 1

Which operating-system component normally executes privileged instructions and manages protected hardware resources?

A. Application program

B. Kernel

C. Spreadsheet

D. Container image

Correct Answer: B. Kernel

Question 2

A process is most likely to enter a blocked state when it is:

A. Waiting for an input/output operation to complete

B. Being assigned a higher priority

C. Stored permanently in a source-code repository

D. Running without any resource request

Correct Answer: A. Waiting for an input/output operation to complete

Question 3

If a resource is busy for 75 minutes during a 100-minute observation period, its utilization is:

A. 7.5%

B. 25%

C. 75%

D. 175%

Correct Answer: C. 75%

Question 4

Which principle grants a user or service only the permissions necessary for its task?

A. Open access

B. Least privilege

C. Resource overcommitment

D. Load balancing

Correct Answer: B. Least privilege

Question 5

What is the defining characteristic of a Type 1 hypervisor?

A. It runs directly on physical hardware

B. It can run only inside a container

C. It requires a guest operating system for every process

D. It is exclusively a desktop application

Correct Answer: A. It runs directly on physical hardware

Question 6

A virtual machine normally differs from a container because the VM:

A. Cannot use network communication

B. Includes a guest operating system

C. Cannot be isolated from other workloads

D. Always uses less memory

Correct Answer: B. Includes a guest operating system

Question 7

Which technology generally provides rapid startup by sharing the host operating-system kernel?

A. Container

B. Physical server

C. Tape archive

D. Firmware chip

Correct Answer: A. Container

Question 8

Why can excessive VM overcommitment be risky?

A. It guarantees that all workloads receive maximum performance

B. It may cause contention when workloads peak simultaneously

C. It permanently eliminates storage latency

D. It prevents resource monitoring

Correct Answer: B. It may cause contention when workloads peak simultaneously

Question 9

Which control is most directly intended to reduce the attack surface of an operating system?

A. Disabling unnecessary services

B. Increasing screen resolution

C. Adding duplicate filenames

D. Removing audit records

Correct Answer: A. Disabling unnecessary services

Question 10

Which deployment choice is generally most suitable for a legacy application requiring a different guest operating system and strong workload separation?

A. A virtual machine

B. An unprivileged text file

C. A shared document folder

D. A browser bookmark

Correct Answer: A. A virtual machine