Linux Namespaces and cgroups
How do Linux namespaces and cgroups enable containers?
Answers use simple, clear English.
Audio N/AQuick interview answer
Namespaces virtualize kernel resources (PID, mount, network, UTS, IPC, user) so a process sees its own isolated view. cgroups limit/account CPU, memory, IO. Combined with union filesystems and seccomp, this builds containers without a full hypervisor guest OS.
Detailed answer
Namespaces virtualize kernel resources (PID, mount, network, UTS, IPC, user) so a process sees its own isolated view. cgroups limit/account CPU, memory, IO. Combined with union filesystems and seccomp, this builds containers without a full hypervisor guest OS. Containers share the host kernel — kernel exploits are a shared risk.
Full explanation
Containers share the host kernel — kernel exploits are a shared risk.
Real example & use case
Kubernetes pod gets a memory cgroup limit so a leaky process is OOM-killed without taking down the node immediately.
Pros & cons
Pros: lightweight isolation. Cons: weaker than VMs for hostile multi-tenant kernels.