Linux namespace
Kernel mechanism that gives processes an isolated view of system resources. Container = process + namespaces + cgroup. Seven types: PID, NET, MNT, UTS, IPC, USER, CGROUP.
Mount namespaces first (2002), the rest landed 2006–2013. PID namespace = a process thinks it's PID 1, can't see processes in other namespaces. NET namespace = its own interfaces, routing, firewall. Container runtimes (runc, crun) create namespaces for each container. The unshare command lets you manually create namespaces for debugging.