> isolation layer: the piece that limits privileges and resource usage. (On linux, this is usually handled by cgroups and the kernel Clarification: cgroups onl

> isolation layer: the piece that limits privileges and resource usage. (On linux, this is usually handled by cgroups and the kernel Clarification: cgroups only control access to compute resources, like CPU time and memory. To control privileges, e.g. access to the filesystem or network, you need namespaces, which are a completely separate kernel feature.