Containers

Big picture: a container is a process with a private view of the system. Namespaces are that view. OCI is the standard for how you pack and start it.

Reading order

1. Namespaces: mount, UTS, IPC, PID, network, user, and cgroup. Each one hides a different resource.
2. OCI: the runtime spec and the image spec built on top of that isolation.

Related

• Linux users and groups: user namespaces remap UIDs, the same idea as ID mapping.
• Docker privileges: a mode that hands the container back most of the host.
• The network: the bridge, the veth pair, and the route tables.
• Kubernetes: scheduling these processes across a cluster.