Side by Side
| KVM | Container (OpenVZ, LXC) | |
|---|---|---|
| Kernel | Its own, which you can update and configure | The host's, shared with every other container |
| Operating systems | Any Linux, BSD or Windows | Linux only, on the host's kernel version |
| Docker | Works as on any server | Limited or unavailable, depending on the host |
| WireGuard and kernel modules | Load what you need | Only what the host provides |
| Memory | A fixed amount, reserved for your server | Often a limit inside a shared pool |
| Isolation | Hardware virtualization | Kernel namespaces and cgroups |
| Overhead | Slightly more | Very little |
How KVM Works
KVM is the hypervisor built into Linux. It uses the processor's virtualization features to run each VPS as a separate machine with virtual hardware: its own kernel, its own memory and its own disks. Nothing inside one VPS can see the others, and you can do anything you could on a physical server, from installing a different kernel to running Windows.
How Containers Work
OpenVZ and LXC run each VPS as a group of processes on the host's own kernel, separated by kernel features (namespaces and cgroups). There is no second kernel to boot, so containers start in seconds and use very little overhead. The catch is that everything kernel-level belongs to the host: the version, the modules loaded, and which features, such as TUN devices for VPNs or nested containers for Docker, the host chooses to allow.
Where the Difference Shows
- Docker. It needs kernel features that many container hosts do not offer, so it fails or runs with odd limits. On KVM it works as documented; see How to run Docker on a VPS.
- VPNs. WireGuard is a kernel module. In a container you depend on the host having it, or fall back to slower user-space versions. On KVM: How to set up WireGuard on a VPS.
- Memory. A container's memory may be shared with others on the host, so what the plan says and what you can rely on under load can differ. A KVM server's memory is assigned to it.
- Windows. Only possible on KVM.