Namespaces and Cgroups
Container is just a regular process, that has been isolated using various system techniques through namespaces and limited in resource via cgroups. All the container technologies (Docker, Podman, Nerdctl etc.) just automate that process.
Which resources can be shared between containers depends on which namespaces are used. Two
containers can share, say, the network namespace (so they see the same interfaces and can talk over
localhost) while still having separate PID and mount namespaces, so each still sees only its own
processes and filesystem. This is how Kubernetes pods work: containers in the same pod share a
network namespace, but not a PID or mount namespace.
Important distinction is between container and VM (virtual machine). Container is really a isolated process inside host machine, while VM has it's own kernel and runs under a hypervisor, either type 1 (runs directly on hardware) or type 2 (runs as an application on a host OS).
Namespaces
A namespace partitions a specific kind of kernel resource so a process only sees its own slice of it. The main ones:
- PID - isolates process IDs, so a process can be PID 1 inside its namespace while being some other PID on the host.
- Mount - isolates the set of filesystem mount points a process sees, so each container can have its own root filesystem.
- Network - isolates network interfaces, routing tables, and ports, so a container can behave as if it has its own network card.
- IPC - isolates inter-process communication resources like shared memory segments and message queues.
- UTS - isolates hostname and domain name.
- User - isolates user and group IDs, so a process can be root inside its namespace without being root on the host.
Each namespace only isolates its own resource type. A process can be given some namespaces and not others, which is why isolation between two containers isn't all-or-nothing.
Cgroups
Cgroups (control groups) limit how much of a resource a process can use — CPU time, memory, block I/O, and so on. Namespaces control visibility, cgroups control consumption. A process fully isolated by namespaces could still starve the host of CPU or memory without a cgroup restricting it.
What actually makes something a container
The minimal requirement is filesystem and PID isolation. PID isolation matters more than filesystem
isolation, because filesystem isolation alone is achievable with just chroot (change root) — a
much older mechanism than namespaces. A chroot jail changes the root directory a process (and its
children) sees, but the process still shares the host's PID space: running ps inside a chroot
shows every process on the host, not just its own.
Cgroups belong on this list too. Without a resource cap, an "isolated" process can still exhaust memory or CPU for everything else on the host, which defeats the point of isolating it in the first place.
Glossary
Hypervisor
Software that creates and runs VMs by exposing virtualized hardware to them. A type 1 (bare-metal) hypervisor runs directly on the host hardware, e.g. Proxmox VE or KVM; a type 2 (hosted) hypervisor runs as an application on top of a regular host OS, e.g. VirtualBox.