How much memory overhead does your Docker container really have?

TL/DR:

Each container had around 7.4MiB of host memory overhead for Docker shim and proxy services.
Binding only IPv4 port got that down to 6.2MiB per container by running half the proxies.
Configuring Docker with userland-proxy: false avoids the proxy altogether and gets overhead down to 4.3MiB
Memory usage between Ubuntu and Alpine was mostly the same other than a few exceptions.
Rust (1MiB) beats Go (1.5MiB), with Python in the middle (9.4/10.9MiB), followed by TypeScript (~15MiB) and C# last (18.5MiB).
Measuring after 200 requests and 15s of settling afterwards, keeps the order but TypeScript and C# fall further behind: Rust (1MiB), Go (3/5MiB), Python (9.7-11MiB), TypeScript (20/26MiB) and finally C# (30/31MiB).
dockerd at ~70MiB and containerd at ~50MiB were relatively stable between runs.
Ubuntu surprisingly beat Alpine variants in Go (2.9MiB vs 4.9MiB) and Python (9.7MiB vs 11.1MiB) while losing in TypeScript (26.2MiB vs 20.1MiB).

Scope

I was looking to understand overhead of using Docker to run simple network services (basic "Hello World" API service) in different language runtimes and using different base OSes (Alpine Linux and Ubuntu 26.04), and any simple systemic options to optimize that a bit.

The five languages I wanted to compare were Go, Rust, TypeScript, Python and C#.

Methodology

The benchmark was really simple: a basic API handler returning "Hello World" string using whatever the Claude Code/Codex thought made sense as the simplest web framework for the language: Tokio for Rust, ThreadingHTTPServer for Python, node:http for TypeScript, net/http for GoLang and WebApplication for C#. This is not representative of production loads and is mostly to understand the overhead before you start adding actual business logic inside.

Early on, Claude Code mentioned 2 proxy processes for each container: one to bind to IPv4 port, and another to bind to IPv6 port. This made me check: in the idle state (containers stopped and then restarted), baseline memory usage was around 7.4MiB when both IPv4 and IPv6 were proxied, and 6.2MiB with just IPv4 (down by about 1.2MiBper container). From there on, I focused on running with only IPv4 assuming you can always choose which one you prefer for your internal docker communication.

For every run of the benchmarks, I'd stop the docker services (docker compose stop), restart them and only then run the benchmark script with sudo to collect PSS data as RSS was double-counting. Claude Code and OpenAI Codex both contributed to the benchmark scripts which are pushed to git@github.com:dsegan/docker-memory-overhead.git.

To gather idle data, I did sudo scripts/report.sh report --requests 0 --settle 15 --samples 1, and for warm data I did sudo scripts/report.sh report --requests 200 --settle 15 --samples 5.

Idle Results for both IPv4 and IPv6 being served

service	current	WS	anon	file	kernel	peak	tasks	host tax	estimate	endpoint
csharp-alpine	18.1	18.1	8.4	7.9	1.6	18.5	22	7.4	25.5	ok
csharp-ubuntu	18.5	18.5	8.9	7.9	1.8	19.3	22	7.4	25.9	ok
go-alpine	1.6	1.6	1.1	0.0	0.5	4.9	5	7.3	8.9	ok
go-ubuntu	1.6	1.6	1.2	0.0	0.5	4.7	5	7.6	9.2	ok
python-alpine	10.9	10.9	10.4	0.0	0.5	13.5	1	7.4	18.3	ok
python-ubuntu	9.4	9.4	8.8	0.0	0.6	10.1	1	7.7	17.1	ok
rust-alpine	0.8	0.8	0.2	0.0	0.6	5.2	9	7.4	8.1	ok
rust-ubuntu	1.0	1.0	0.4	0.0	0.6	5.2	9	7.4	8.4	ok
typescript-alpine	13.0	13.0	11.9	0.0	1.1	16.7	7	7.3	20.3	ok
typescript-ubuntu	17.6	17.6	16.4	0.0	1.2	21.8	7	7.4	25.1	ok
Sum	92.5	92.5	67.7	15.8	9.0	119.9	88	74.3	166.8	10/10 ok

Idle Results with just IPv4

service	current	WS	anon	file	kernel	peak	tasks	host tax	estimate	endpoint
csharp-alpine	21.3	18.5	8.4	10.9	1.6	21.6	22	6.0	24.5	ok
csharp-ubuntu	21.9	18.7	8.8	11.3	1.8	22.5	23	6.3	25.0	ok
go-alpine	3.7	1.5	1.0	2.2	0.5	5.4	5	6.4	7.9	ok
go-ubuntu	1.7	1.6	1.1	0.1	0.5	4.7	5	6.0	7.6	ok
python-alpine	12.3	10.9	10.4	1.3	0.5	14.7	1	6.3	17.2	ok
python-ubuntu	10.6	9.4	8.8	1.1	0.6	11.7	1	6.4	15.8	ok
rust-alpine	0.8	0.8	0.2	0.0	0.6	5.5	9	6.2	7.0	ok
rust-ubuntu	1.1	1.0	0.4	0.1	0.6	5.4	9	6.1	7.1	ok
typescript-alpine	14.7	13.1	11.9	1.6	1.2	17.8	7	6.3	19.4	ok
typescript-ubuntu	19.2	17.7	16.4	1.5	1.2	23.2	7	6.3	23.9	ok
Total	107.3	93.2	67.4	30.1	9.1	132.5	89	62.3	155.4	10/10 ok

Warm results with both IPv4 and IPv6

service	current	WS	anon	file	kernel	peak	tasks	host tax	estimate	endpoint
csharp-alpine	50.5	30.1	11.1	37.3	1.9	50.9	24	7.7	37.8	ok
csharp-ubuntu	48.7	31.5	11.6	35.1	1.9	49.2	23	7.8	39.2	ok
go-alpine	4.9	4.9	2.1	2.3	0.5	6.1	6	7.7	12.7	ok
go-ubuntu	4.9	2.9	2.1	2.3	0.5	6.2	5	7.8	10.7	ok
python-alpine	17.7	11.1	10.4	6.6	0.6	20.0	1	7.8	18.9	ok
python-ubuntu	13.9	9.7	8.9	4.3	0.7	15.6	1	7.8	17.5	ok
rust-alpine	1.3	0.9	0.2	0.5	0.6	5.1	9	7.7	8.6	ok
rust-ubuntu	1.5	1.1	0.4	0.4	0.6	5.2	9	7.7	8.8	ok
typescript-alpine	44.9	20.1	14.1	29.4	1.4	47.1	7	7.9	28.0	ok
typescript-ubuntu	58.9	26.2	20.2	37.2	1.5	59.6	7	8.0	34.3	ok
Total	247.2	138.5	81.1	155.4	10.2	265.0	92	77.9	216.5	10/10 ok

Warm results with just IPv4

service	current	WS	anon	file	kernel	swap	peak	tasks	host tax	estimate	endpoint
csharp-alpine	38.1	25.7	11.1	24.8	1.8	0.0	43.3	24	6.5	32.2	ok
csharp-ubuntu	39.0	25.3	12.3	24.5	1.9	0.0	45.0	24	6.3	31.6	ok
go-alpine	2.7	2.2	2.0	0.5	0.5	0.1	4.9	5	6.5	8.7	ok
go-ubuntu	3.7	2.6	2.1	1.2	0.5	0.0	5.5	5	6.3	8.8	ok
python-alpine	12.1	10.8	10.4	1.2	0.4	0.0	19.0	1	6.3	17.1	ok
python-ubuntu	10.8	9.3	8.9	1.6	0.4	0.0	14.1	1	6.4	15.6	ok
rust-alpine	1.3	0.8	0.2	0.5	0.6	0.0	5.2	9	6.2	7.0	ok
rust-ubuntu	1.5	1.0	0.4	0.4	0.6	0.0	4.9	9	6.3	7.3	ok
typescript-alpine	19.8	15.9	14.4	4.2	1.2	0.0	40.5	7	6.4	22.4	ok
typescript-ubuntu	26.2	21.6	20.1	4.8	1.3	0.0	51.8	7	6.4	28.0	ok
Total	155.2	115.2	81.9	63.7	9.2	0.1	234.2	92	63.6	178.7	10/10 ok

userland-proxy: false

service	current	WS	anon	file	kernel	peak	tasks	host tax	estimate	endpoint
csharp-alpine	47.1	33.9	9.2	35.8	1.7	49.1	23	4.4	38.3	ok
csharp-ubuntu	50.6	38.4	13.6	35.2	1.8	51.3	22	4.3	42.7	ok
go-alpine	4.8	3.6	2.1	2.3	0.5	6.2	5	4.3	7.9	ok
go-ubuntu	5.1	3.8	2.3	2.3	0.5	6.1	5	4.5	8.3	ok
python-alpine	17.3	12.4	10.4	6.3	0.5	19.8	1	4.3	16.7	ok
python-ubuntu	15.4	10.9	8.9	5.9	0.6	17.3	1	4.2	15.1	ok
rust-alpine	1.3	1.1	0.2	0.5	0.6	5.1	9	4.5	5.6	ok
rust-ubuntu	1.5	1.3	0.4	0.4	0.6	5.4	9	4.3	5.6	ok
typescript-alpine	44.1	19.3	14.4	28.4	1.2	46.3	7	4.5	23.8	ok
typescript-ubuntu	51.9	25.5	20.3	30.3	1.3	52.6	7	4.3	29.8	ok
Total	239.1	150.2	81.8	147.4	9.3	259.2	89	43.6	193.8	10/10 ok

Options & Alternatives

If getting the overhead down is the goal, there are tools which you can leverage which may or may not be suitable:

Drop the userland-proxy from Docker Daemon.
Avoid languages which aggressively use up your memory: Rust and Go are clear winners, with a surprising show from Python staying mostly stable, and bad results from NodeJS and C#.
Podman is daemonless and might avoid the overhead altogether.
LXD/Incus might be worth exploring, but they provide system containers vs application containers.
Systemd units with sandboxing (but without filesystem isolation) between services should get the overhead down to zero.
Snaps to add filesystem isolation to a feature-set similar to systemd units — but not designed for this type of use-case.
...

Conclusions

Docker is not well suited to running on low-memory platforms as always-running daemons take around 100MiB of memory, on top of 4-6-8MiB of additional memory per container: a system with 20 containers will use up 220MiB of RAM just to orchestrate containers, and that's without any service actually operating. With 20 Rust or Go services you might just about fit into 256MiB of RAM, but you'll be looking OOMs in the face. If you are using anything else, 512MiB is going to be low as well.

Finally, take the above results with a (big) grain of salt: benchmark code has been built by LLMs, and it is not representative of any production loads.

Блогчетање Sep 2026