Linux Namespaces and cgroups
How do Linux namespaces and cgroups enable containers?
Answers use simple, clear English.
Quick interview answer
Namespaces virtualize kernel resources (PID, mount, network, UTS, IPC, user) so a process sees its own isolated view. cgroups limit/account CPU, memory, IO. Combined with union filesystems and seccomp, this builds containers without a full hypervisor guest OS.
Detailed answer
Namespaces virtualize kernel resources (PID, mount, network, UTS, IPC, user) so a process sees its own isolated view. cgroups limit/account CPU, memory, IO. Combined with union filesystems and seccomp, this builds containers without a full hypervisor guest OS. Containers share the host kernel — kernel exploits are a shared risk.
Full explanation
Containers share the host kernel — kernel exploits are a shared risk.
Real example & use case
Kubernetes pod gets a memory cgroup limit so a leaky process is OOM-killed without taking down the node immediately.
Pros & cons
Pros: lightweight isolation. Cons: weaker than VMs for hostile multi-tenant kernels.