Containers are not mini virtual machines. A VM virtualizes hardware and runs its own kernel; a container shares the host's kernel and uses a handful of kernel features to create the illusion of separation. Understanding those features makes Docker behavior — and Docker failures — much easier to reason about.

Here are the five kernel mechanisms that do the actual work.

1. Namespaces: what a process can see

Namespaces partition global system resources so that each process group sees its own view. The important ones:

pid — the container sees its own process tree, starting at PID 1.

net — the container gets its own network stack, interfaces, and routing table.

mnt — the container sees only the mounts given to it, not the host's filesystem.

ipc and user — isolate inter-process communication and user/group IDs.

Namespaces are isolation, not a security boundary. A process inside a container still makes syscalls to the same host kernel.

2.…