A container packages an application together with its libraries, runtime, and config into one isolated unit that runs identically on any host. Unlike a virtual machine, containers share the host OS kernel, so they start in milliseconds and are far lighter — Docker popularized the format.
Worked example: “works on my machine” goes away because the container ships the exact environment — the same image runs on a laptop, in CI, and in production. Gotcha: containers isolate processes and filesystems but share the kernel, so they are a weaker security boundary than VMs (a kernel exploit can escape) — and they are meant to be ephemeral and stateless; persistent data must live in a mounted volume or external store, not inside the container.