a namespace

A namespace is the kernel feature that gives a container its private, isolated view of the system — it is what makes a group of processes feel like they are alone on their own machine even though they are sharing the host. Think of a one-way mirror in a room: the people inside can only see what is in their room, and they have no idea there are other rooms full of people right next door using the same building. A namespace wraps a set of system resources so that processes inside it see only their own slice and are blind to everyone else's.

There is not one namespace but several kinds, each isolating a different resource, and you combine them. A PID namespace gives the container its own process numbers, so its first process is PID 1 and it cannot even see the host's other processes. A mount namespace gives it its own file-system layout and root directory. A network namespace gives it its own network interfaces and addresses. A user namespace lets it have its own user and group IDs (so root inside the container need not be root on the host). There are more (for hostnames, inter-process communication, and so on). Each is just the kernel keeping a separate table of who-can-see-what for the processes tagged with that namespace.

Namespaces matter because they are the isolation half of what makes a container: they answer the question what does this process get to see. Pair them with control groups, which answer how much can it use, and you have the core of containerization built from plain kernel mechanisms, no hypervisor required. The honest caveat is that namespaces virtualize the view, not the kernel itself — every namespaced process still runs on the one shared host kernel, so namespaces alone are a visibility boundary, not a security wall as strong as a separate machine.