Docker Made Crystal Clear · chapter 2: What a Container Actually Is
A container, opened up
2026-09-03
One ordinary process sits at the center. The eight namespaces (Cgroup, IPC, Network, Mount, PID, Time, User, UTS, exactly as the Linux manual lists them) control what it can see; cgroups control how much it may use; and everything runs on the host's single kernel. Docker's flags like --memory and --pids-limit are a friendly interface to the cgroup limits.
Below: the paragraph from the book that builds this idea, then the diagram itself (Figure 2.2), and a recap. About a minute of reading.
Here is the sentence to keep: namespaces answer "what can the process see"; cgroups answer "how much can the process use". Put both around one ordinary process, hand it a packaged filesystem to treat as /, and you have a container. Figure 2.2 draws exactly that, and notice what the picture does not contain: no hypervisor, no guest kernel, anywhere.
Recap
- The idea: One ordinary process sits at the center.
- The picture: Figure 2.2, from chapter 2 ("What a Container Actually Is") of Docker Made Crystal Clear.
- Go deeper: the chapter builds this step by step, with recipes and sources at the end.
This diagram is one of many in Docker Made Crystal Clear.
Every chapter opens with the gist, draws the hard ideas, and ends with recipes and sources.
Get the book
