Its namespaces. Cgroups can be used to limit any Linux processes and do not have anything in particular to do with containers. Userland container managers use i

Its namespaces. Cgroups can be used to limit any Linux processes and do not have anything in particular to do with containers. Userland container managers use it to limit mainly cpu and memory resources to the container processes. Its kernel namespaces that enable containers and allow one to launch a process in its own namespace(there are 5 namespaces containers use). LXC/LXD containers launch an init in this process so you get a more VM like environment. Docker does not launch an init so you run a single app process or a process manager if you need to run multiple processes. Systemd Nspawn is similar to LXC.