How do Linux Namespaces and Cgroups (Control Groups) power container isolation under the hood?
❓ Interview Prompt: Explain the 7 Linux namespaces (pid, net, mnt, ipc, uts, user, cgroup) and cgroup v2 resource accounting that enable container isolation.
Containers are not magic — they are processes running on the host with two Linux kernel features restricting what they can see and use:
Linux Namespaces (Isolation — What Can Be Seen):
Namespaces limit the visibility of global system resources:
| Namespace | Isolates |
|---|---|
| pid | Process IDs — container only sees its own processes |
| net | Network interfaces, routes, iptables rules |
| mnt | Filesystem mount points — container has its own root filesystem |
| ipc | Inter-process communication (shared memory, semaphores) |
| uts | Hostname and domain name |
| user | User and group IDs (UID/GID mapping) |
| cgroup | Cgroup hierarchy visibility |
Cgroups v2 (Resource Accounting — How Much Can Be Used):
Control Groups enforce resource limits on a group of processes:
How Docker Uses Them:
docker run --memory=512m --cpus=1 translates to writing values into cgroup v2 pseudo-files under /sys/fs/cgroup/.
Code Implementation Example
# Inspect namespaces of a running container (PID 1234)
ls -la /proc/1234/ns/
# lrwxrwxrwx net -> net:[4026532xxx] ← unique net namespace
# lrwxrwxrwx pid -> pid:[4026532yyy] ← unique pid namespace
# lrwxrwxrwx mnt -> mnt:[4026532zzz] ← unique mount namespace
# Enter a container's namespace (like docker exec under the hood)
nsenter --target 1234 --pid --net --mount --ipc -- bash
# Inspect cgroup limits for a Docker container
CONTAINER_ID=$(docker inspect myapp --format '{{.Id}}')
cat /sys/fs/cgroup/memory/${CONTAINER_ID}/memory.max
# 536870912 ← 512MB in bytes
cat /sys/fs/cgroup/cpu/${CONTAINER_ID}/cpu.max
# 100000 100000 ← 1 CPU core (100ms per 100ms period)Containers are Linux processes isolated by 7 namespaces (visibility) and bounded by cgroup v2 (resource limits) — no separate OS kernel required.