A job (as part of a workflow) runs inside a virtual machine. You choose one of the environments provided by them (e.g. ubuntu-latest or windows-2019).

A job consists of one or more steps. A step may be a simple shell command, using run. But it may also be an action, using uses

name: CI

on: [push]

jobs:
  myjob:
    runs-on: ubuntu-18.04 # linux required if you want to use docker
    steps:
    # Those steps are executed directly on the VM
    - run: ls /
    - run: echo $HOME
    - name: Add a file
      run: touch $HOME/stuff.txt
    # Those steps are actions, which may run inside a container
    - uses: actions/checkout@v1
    - uses: ./.github/actions/my-action
    - uses: docker://continuumio/anaconda3:2019.07

• run: <COMMAND> executes the command with the shell of the OS
• uses: actions/checkout@v1 runs the action from the user / organization actions in the repository checkout (https://github.com/actions/checkout), major release 1
• uses: ./.github/actions/my-action runs the action which is defined in your own repository under this path
• uses: docker://continuumio/anaconda3:2019.07 runs the anaconda3 image from user / organization continuumio, version 2019.07, from the Docker Hub (https://hub.docker.com/r/continuumio/anaconda3)

Keep in mind that you need to select a linux distribution as the environment if you want to use Docker.

Take a look at the documentation for uses and run for further details.

It should also be noted that there is a container option, allowing you to run any steps that would usually run on the host to be runned inside a container: https://help.github.com/en/articles/workflow-syntax-for-github-actions#jobsjob_idcontainer

GitHub actions provision a virtual machine - as you noted, either Ubuntu, Windows or macOS - and run your workflow inside of that. You can then use that virtual machine to run a workflow inside a container.

Use the container specifier to run a step inside a container. Be sure to specify runs-on as the appropriate host environment for your container (ubuntu-latest for Linux containers, windows-latest for Windows containers). For example:

jobs:
  vm:
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo This job does not specify a container.
          echo It runs directly on the virtual machine.
        name: Run on VM
  container:
    runs-on: ubuntu-latest
    container: node:10.16-jessie
    steps:
      - run: |
          echo This job does specify a container.
          echo It runs in the container instead of the VM.
        name: Run in container