A container is a process running on a host OS, isolated using Linux kernel features (namespaces and cgroups). It's not a VM. There's no guest kernel.
- Namespaces — provide isolation (process, network, mount, user, IPC)
- cgroups — limit resources (CPU, memory, I/O)
- Container image — read-only layered filesystem packaged as a tarball
- Container runtime — what actually runs containers (containerd, CRI-O, Docker Engine)