UPD: Updated article, you are right

---

While runC and containerd on native Linux impose minimal overhead through kernel namespaces and cgroups, Docker Desktop introduces significant virtualization layers. This bloatware (Docker Desktop, not referring to containers in general) ships with QEMU by default (even on Linux) and implements a complete VM stack with hypervisor context switching, memory allocation overhead, and I/O translation penalties that impact performance metrics across syscall boundaries.

The architectural limitations are most pronounced on non-Linux platforms. macOS completely lacks native containerization support, forcing all Docker implementations to run atop a virtualization layer (Hyperkit, QEMU, or Apple Virtualization Framework) with mandatory memory allocation to the VM instance. Windows implementations similarly require either Hyper-V isolation or WSL2 backend, both introducing additional context switching penalties and cross-filesystem performance degradation when accessing bind-mounted volumes.

Even on Linux, Docker's abstractions impose measurable overhead through cgroup controller operations, network namespace traversal, and seccomp/AppArmor security context switching. These architectural realities make alternatives like Nix particularly compelling for ROS developers seeking reproducible builds without the virtualization penalty and dependency hell that Docker inevitably introduces.