Namespaces & cgroups
What Makes a Container
Containers are not lightweight VMs - they're isolated processes on the host kernel, built from two kernel features:
| Feature | Provides |
|---|
| Namespaces | Isolation - each container sees its own PIDs, network, mounts, hostname, users |
| cgroups | Limits - cap CPU, memory, I/O, PIDs per group of processes |
| Isolation vs | VM | Container |
|---|
| Kernel | Own kernel | Shares host kernel |
| Boot time | Seconds-minutes | Milliseconds |
| Overhead | High (full OS) | Low |
| Isolation strength | Strong (hardware) | Weaker (kernel) |
Exam tip: The seven namespaces (PID, NET, MNT, UTS, IPC, USER, CGROUP) + cgroups are the answer to "how do containers isolate without a hypervisor?"