What makes it possible to run multiple isolated environments on a single local machine (Docker/containerization)?

Running multiple isolated environments on a single local machine using Docker and containerization becomes possible thanks to the capabilities of the Linux OS kernel, such as namespaces and cgroups.

Namespaces provide isolation of various aspects of the environment: processes (PID namespace), network (network namespace), filesystem (mount namespace), users (user namespace), and others. This allows containers to see and manage only their resources without affecting others.

Cgroups (control groups) limit and control resource usage (CPU, memory, disk, network) for each container, preventing mutual influence and ensuring resource guarantees.

Thus, containers operate as lightweight virtual machines, sharing the OS kernel but isolating processes and resources, enabling the running of many independent environments on a single machine without full virtualization.

Example:

• PID namespace: processes in the container see only their processes.
• Network namespace: the container has its own network stack.
• Cgroups: limit the container's memory to a specified limit.