VM vs Container
- VM: hardware-level isolation, full OS (~GB), starts in minutes, maximum security
- Container: process-level isolation, shared host kernel (~MB), starts in seconds, slightly less isolation
When VM, when container
VMs — when strong isolation is required (different OSes, compliance, untrusted code). Containers — for most microservice applications where startup speed and density matter.