Container comprises several building blocks, the two most important being namespaces and cgroups (control groups). Both of them are Linux kernel features. Namespaces provide logical partitions of certain kinds of system resources, such as mounting point (mnt), process ID (PID), network (net), and so on. To explain the concept of isolation, let's look at some simple examples on the pid namespace. The following examples are all from Ubuntu 16.04.2 and util-linux 2.27.1.
When we type ps axf, we will see a long list of running processes:
$ ps axf
PID TTY STAT TIME COMMAND
2 ? S 0:00 [kthreadd]
3 ? S 0:42 \_ [ksoftirqd/0]
5 ? S< 0:00 \_ [kworker/0:0H]
7 ? S 8:14 \_ [rcu_sched]
8 ? S 0:00 \_ [rcu_bh]
ps is a utility to report ...
