What does "docker exec" rely on internally to enter a running container's namespaces, and how does this differ conceptually from starting a new container?

A "docker exec" creates a completely new container sharing the same image B "docker exec" uses "setns" to join the existing namespaces (PID, network, mount, etc.) of an already-running container's init process, running a new process in that same isolated environment rather than creating a new one C "docker exec" copies the entire container filesystem to a temporary location first D "docker exec" requires stopping the container first