Container
Isolated user-space process tree bounded by Linux namespaces and cgroups sharing the host kernel.
Mechanism & Definition
A container is not a lightweight virtual machine; it is a standard Linux process isolated at runtime. The host Linux kernel enforces isolation using namespaces (PID, NET, MNT, IPC, UTS, USER) and constrains resource consumption (CPU, memory, I/O) using cgroups. Containers share the host kernel directly, eliminating hypervisor overhead.