Docker中的共享内核是什么意思？

有人可以详细说明它.

让我有一些内核版本的centos,当我们拉ubuntu图像然后它有不同的内核,那我们怎么能说他们有相同的内核？

when we pull ubuntu image then it have different kernel

不,它没有：它没有内核部分：它依赖于所有system calls的主机内核(运行docker引擎的内核).

如“Docker vs Virtualization”中所述：

Initially Docker was built as an abstraction layer on top of Linux Containers (LXC). LXC itself is a just an API for the Linux containment features.
Starting with Docker 0.9, LXC is not the default anymore and has been replaced with a custom library (libcontainer) written in Go. Overall libcontainer’s advantage is a more consistent interface to the Kernel across various Linux distributions. The only gotcha is that it requires Linux 3.8 and higher.

查看更多“Why Understanding User Space vs. Kernel Space Matters”.
另外“Operating System Containers vs. Application Containers”：

Containers are the products of operating system virtualization. They provide a lightweight virtual environment that groups and isolates a set of processes and resources such as memory, CPU, disk, etc., from the host and any other containers.
The isolation guarantees that any processes inside the container cannot see any processes or resources outside the container.

OS containers are virtual environments that share the kernel of the host operating system but provide user space isolation

正如“Do all Linux distros use the same kernel?”中所提到的,即使每个发行版都有自己的内核配置,也可以在发行版中共享内核.

如果需要更多隔离,请考虑gVisor(https://github.com/google/gvisor),这是一个容器沙箱运行时,专注于安全性,效率和易用性. (2018).
见架构：

gVisor intercepts application system calls and acts as the guest kernel, without the need for translation through virtualized hardware.

gVisor may be thought of as either a merged guest kernel and VMM, or as seccomp on steroids.
This architecture allows it to provide a flexible resource footprint (i.e. one based on threads and memory mappings, not fixed guest physical resources) while also lowering the fixed costs of virtualization.
However, this comes at the price of reduced application compatibility and higher per-system call overhead.