Containers are a nice clean abstraction: a system within a system, where every process running inside it shares the container's filesystem, PID list, and networ

Containers are a nice clean abstraction: a system within a system, where every process running inside it shares the container's filesystem, PID list, and networking. Things can get a little gnarly when the abstraction leaks, but in principle they're easy to understand. This is a lot uglier precisely because it's not total isolation: the processes that use it share most of their filesystem view, networking, etc with the rest of the system, can interact with everything else on the system, but some of their filesystem view is different and the exact difference depends on when the process was started.