Container technologies such as Docker use isolation features offered by modern operating systems, such as namespaces and control groups (cgroups) in Linux. Using these features allows the operating system to isolate multiple running processes from each other to a very large extent. For example, a container runtime might provide two processes with two entirely separate filmount namespaces or two separate networking stacks using network namespaces. In addition to namespaces, cgroups can be used to ensure that each process does not use more than a previously allocated amount of resources (such as CPU time, memory or I/O, and network bandwidth).
In contrast to traditional virtual machines, a container runs completely within the operating system of the host environment; there is no virtualized hardware and OS running on that. Also, in many container runtimes...
