no mention of kernel namespaces, which actually enable this functionality. I wonder what proportion of people think that Docker enforces the separation between

no mention of kernel namespaces, which actually enable this functionality. I wonder what proportion of people think that Docker enforces the separation between inside and outside a container.