Container security fundamentals part 2: Isolation & namespaces

This article explains how Linux namespaces underpin container isolation and how to inspect, share, and troubleshoot these layers (mount, PID, network, cgroup, IPC, UTS, time, user) using tools like lsns, nsenter, unshare, and Docker/Kubernetes features, highlighting security considerations such as hardening access to container filesystems (e.g., /var/lib/docker), preventing cgroup information leakage, the role and limits of user namespaces, and practical debugging methods including namespace sharing and ephemeral containers.