Platform & DevOps·Packaging: containers and images
the container sees PID 1, its own network interfaces and its own mount tree, all of which are a partial view of the host's.
Linux namespaces
Also callednamespaces, PID namespace, network namespace
The kernel feature that gives a process a private view of a global resource — process IDs, mounts, network stack, hostname, users. It is the other half of containerisation: namespaces do the isolation, cgroups do the limits. Understanding that both are per-kernel features is what makes it obvious why a container is not a security boundary of the same class as a virtual machine.