A running process, isolated by namespaces and constrained by cgroups — not a mini virtual machine.
An image and a container are related but distinct: an image is a read-only template, and a container is a running (or stopped) instance of that template, with its own thin writable layer stacked on top for any changes made while it runs. Multiple containers can be started from the exact same image, each getting its own independent writable layer and its own isolated view of processes, network, and filesystem.
Containers share the host's kernel rather than running their own — there's no guest OS to boot, which is exactly why containers start in milliseconds compared to a VM. A container's lifecycle is tied directly to its main process (PID 1 inside the container): when that process exits, the container exits too, regardless of any background processes it may have spawned, which is a common surprise for anyone expecting container lifecycle to work like a full OS session.
What you'll walk away knowing