What are Linux namespaces and cgroups, and how do they underpin containers?

Namespaces provide isolation of system resources. Linux has seven namespace types: pid (isolates process IDs — a container sees its own PID 1), net (isolates network interfaces, routing, ports), mnt (isolates filesystem mount points), uts (isolates hostname and domain name), ipc (isolates inter-process communication), user (maps container UIDs to host UIDs), and cgroup (isolates cgroup root). Control groups (cgroups) enforce resource limits: CPU, memory, disk I/O, and network bandwidth. A Docker container is essentially a process (or group of processes) with all seven namespaces applied plus cgroup limits, given a root filesystem image. Understanding namespaces and cgroups explains what containers actually are at the kernel level — not VMs, but isolated process trees.