> given the claims on the website I assumed there was something slightly more clever going on, but the only “special sauce” is the use of aufs to layer one file

> given the claims on the website I assumed there was something slightly more clever going on, but the only “special sauce” is the use of aufs to layer one file system upon another. There's also the network stuff? From docker's website, a simple "docker run ubuntu /bin/echo hello world" does the following: It downloaded the base image from the docker index it created a new LXC container It allocated a filesystem for it Mounted a read-write layer Allocated a network interface Setup an IP for it, with network address translation And then executed a process in there Captured its output and printed it to you