Instance of a docker image. Runs a program with it's own isolated set of hardware resources: memory, network, CPU, disk etc.