user1620696's questions

I've just started to study Docker and there's something that's being quite confusing for me. As I've read on Docker's website a container is different from a virtual machine. As I understood a container is just a sandbox inside of which an entire isolated file system is run.

I've also read that a container doesn't have a Guest OS installed. Instead it relies on the underlying OS Kernel.

All of that is fine. What I'm confused is that there are Docker images named after operating systems. We see images like Ubuntu, Debian, Fedora, CentOS and so on.

My point is: what are those images, really? How is it different creating a container based on the Debian image than creating a Virtual Machine and installing Debian?

I thought containers had no Guest OS installed, but when we create images we base them on some image named after one OS.

Also, in examples I saw when we do docker run ubuntu echo "hello world", it seems we are spinning up a VM with Ubuntu and making it run the command echo "hello world".

In the same way when we do docker run -it ubuntu /bin/bash, it seems we are spinning up a VM with Ubuntu and accessing it using command line.

Anyway, what are those images named after operating systems all about? How different is it to run a container with one of those images and spinning up a VM with the corresponding Guest OS?

Is the idea that we just share the kernel with the host OS (and consequently we have access to the underlying machine hardware resources, without the need to virtualize hardware), but still use the files and binaries of each different system on the containers in order to support whatever application we want to run?

Currently I'm working with permissions on files on the network with Windows Server 2012 Active Directory as follows: I set up one domain controller, on the domain controller I create users and groups. After that, I select one folder to share, and in the sharing options I add everyone with read/write access (I do this because I was told that doing differently gives problems).

Then on subfolders, to restrict the access I go on the security tab of the folders properties and I add groups I want to deny access and deny read/write permissions.

That is fine, however, I'm finding this is not a good approach. Indeed if groups are constantly added and one folder is just meant to be accessed by one group, I'll always need to add the new ones and deny access to them.

One real life scenario on which this may occur is as follows: one company has folders for projects, each project has a certain subsets of the employees working on it. So they create one group for each project, and then on the project's folder only the group for that particular project should have access. If new projects are added, it will require to add the new group on every single project folder and this could be tedious.

So how can one deny access on files and folders more effectively without having to edit the security options when new groups are added?

Suppose we have the following situation: there's one network with a router on which the internet access is configured and this includes the DNS IP's. Then we set up Active Directory on a server on this network and promote it to a domain controller.

When I did that the only way other computers could be included on the domain created was by setting one of their DNS IP's to point to the domain controller. When I did that I was able to make the computers part of the domain. On the other hand, this made those computers stop receiving the DNS address from the router and so they couldn't navigate on the internet.

The solution I found was to add as secondary DNS address on the computers the first DNS address configured on the router. I personally didn't like this approach because of two things:

• The DNS was set up manually in every computers. For just a few it is fine, but if there are many computers this is tedious and if one needs in the future to change this setting would need to change all the computers.

• The only DNS address I could set up was the primary one. The secondary one, found on the router, cannot be used on the computers, because the two available ones are already in use.

So I think this solution is not a good one. How can I correctly set up computers in a domain to use the right DNS entries to navigate the internet and still be able to join the domain by pointing the DNS entry to the domain controller?