Now I mentioned when you create your own Docker images,
you're going to start with a base container image.
In the Docker Hub,
Microsoft regularly updates their Windows base OS container images,
and you need to know these for your AZ‑800 success.
There is the Nano Server image.
This is the lightest,
thinnest version of Windows Server that can run as a container,
and it's limited only to .NET Core apps,
so it's basically for modern development not supporting legacy applications.
If you do want a containerized .NET Framework and legacy applications,
there is a Server Core base image,
and then there is even a Windows Server base image that
includes almost all of the Windows Server features including
the desktop experience features.
Now note though,
that just because that Windows Server image includes
almost all of the underlying OS binaries,
that does not mean you get a graphical interface.
You don't.
None of these containers convey a graphical user interface,
and that's the point.
We want our container images to be as small as possible and to contain
only the bits that are needed to run the application.
Why?
Obviously for security purposes, the smaller the attack surface,
the more secure the container is, right?
Yeah.
Another point is size.
Nano Server is going to be the smallest image, the slimmest image.
Server Core would be second place, and the Windows Server image is much bigger.
Now we haven't really discussed the notion of Linux
versus Windows Server containers.
We have dedicated courses in the Pluralsight library on that subject.
I'll point you to some of them in the exercise files.
I mentioned that Linux is really the home of Docker and containerization.
Nowadays, you can do Linux containers on Windows,
it's beyond our scope though because for the Windows
Server hybrid administrator role, we are truly staying with Windows Server.
One reason Microsoft formed such a deep partnership with
Docker is because they wanted to engineer a way to support
Windows Server in a container ecosystem.
Hence, these three base images.
Another nice thing that you can do with Windows Server‑based Docker containers
running on Windows Server hosts is configure isolation modes,
and this is the question.
How much isolation do you need for your containers
running on a Windows Server host?
The process isolation type is the main default Docker isolation where your
containers are essentially processes on the same Docker host,
and they're using various technologies under the hood in order
to isolate those containers from each other.
If that doesn't do it for your team from a security perspective and
you're looking at Windows Server and not Linux containers,
then you can opt for Hyper‑V isolation.
And what happens here is that you're running your Docker container,
your Windows Server Docker container in basically a slim,
highly‑optimized virtual machine that has its own OS kernel.
So Hyper‑V isolation presents a way to combine the agility
of containerization and the Docker ecosystem with the
isolation and security of Hyper‑V. Now let's do a demo, and let's light up these concepts.