How does containerization work, tell me about namespace in more detail?

Containerization allows isolating applications and their environment so that they work the same way in different environments. The basis of isolation in Linux is namespaces — kernel mechanisms that create separate spaces for processes.

Namespaces divide system resources:

• PID namespace — isolates process identifiers so that processes in a container see only their own PIDs.
• Mount namespace — a separate mount point for the filesystem.
• Network namespace — its own network stack (interfaces, IP addresses).
• UTS namespace — isolation of hostname and domain name.
• IPC namespace — isolation of inter-process communication.
• User namespace — allows mapping UID and GID inside the container differently than on the host, increasing security.

For example, when a container is launched, a set of such namespaces is created, and processes inside it see only their resources, ensuring isolation and security. In Go, you can work with namespaces through system calls, for example, using the syscall package to create new namespaces when launching a process.