Namespaces, cgroups, and the isolation illusion

Processes wearing a disguise

A container is an ordinary host process with a restricted view. Namespaces give it its own process tree, network interfaces, mounts, and hostname; control groups cap how much CPU and memory it can use.

Crucially, the kernel is shared. That is why containers start in milliseconds and why a kernel-level vulnerability is a container escape, whereas a virtual machine has its own kernel and a much stronger boundary.

It also explains the constraints: a Linux container needs a Linux kernel, which is what the virtual machine on a Mac or Windows host is quietly providing.