Lab 1: Container Isolation & Port Forwarding
Containers are NOT mini-virtual machines. A container is simply a standard Linux process running with restricted visibility enforced by the Linux Kernel through 6 Namespaces and Cgroups.
Core Concepts to Understand:
Gives the container its own isolated process tree where your app runs as PID 1, while on the host system it has a regular high PID (e.g. PID 48192).
Creates a virtual ethernet interface (veth) connected to the docker0 bridge. Port forwarding configures iptables NAT rules on the host.
Gives the container its own private root filesystem (/) layered over the host storage without modifying host files.
Linux Kernel Container Isolation Architecture
How Host Kernel isolates PID, Network & Mounts without a Hypervisor
💡 Interactive Concept: Click on any container above to inspect how Linux isolation primitives work under the hood.