Also known as: Linux namespaces · PID namespace · network namespace
A Linux namespace is a kernel feature that gives a process an isolated view of a particular system resource — process IDs, network interfaces, mount points, hostnames — forming the primary isolation mechanism behind containers.
Each namespace type virtualises one resource class. A process in its own PID namespace sees itself as PID 1 and cannot observe processes outside it; in its own network namespace it has entirely separate interfaces and routing tables.
Namespaces provide isolation, not a security boundary equivalent to virtualisation. All namespaced processes still share one kernel, so a kernel vulnerability can breach the boundary — which is the fundamental reason containers are considered weaker isolation than virtual machines.
Container
A container is a process or group of processes running in isolation on a shared kernel, using namespaces for visibility isolation and cgroups for resource limits, packaged with its own filesystem and dependencies.
cgroups
cgroups (control groups) are a Linux kernel feature that limits, accounts for, and isolates the resource usage — CPU, memory, disk I/O, network — of a group of processes.
seccomp
seccomp is a Linux kernel feature that restricts which system calls a process may make, reducing the kernel attack surface available to a compromised or untrusted program.
Kernel
The kernel is the core of an operating system, responsible for managing memory, scheduling processes, and mediating all access between software and hardware. The Linux kernel is the component that makes a system 'Linux'.
System Call
A system call is the mechanism by which a user-space program requests a service from the kernel — such as opening a file, allocating memory, or sending network data — crossing the privilege boundary between application and kernel.