Containers From First Principles

There is no container object in the Linux kernel and no container system call. A container is an ordinary process with several isolation features switched on, all of which predate the technology by years. So the thing that actually changed practice was not the kernel: it was an image format that is immutable, content-addressed and shippable, built on the same idea as Git's object store. This path covers the primitives, the format and its consequences, where data and traffic have to go, and the honest answer on how much the isolation is worth.