Which Linux components form the basis that Docker leverages to isolate processes and resources?

Which Linux components form the basis that Docker leverages to isolate processes and resources?

• A. Kernel threading and sockets
• B. Linux Namespaces and cgroups
• C. Virtual Machines and hypervisors
• D. chroot and mount points

Answer: (B)

The main concept is that Docker relies on Linux kernel features that provide OS-level isolation: Namespaces and cgroups. Namespaces give each container its own isolated view of system resources such as the process list, mount points, network interfaces, IPC, and user IDs, so processes inside a container can’t see or affect processes or resources outside it. Cgroups, short for control groups, enforce limits and track usage of resources like CPU, memory, and I/O, ensuring a container can’t exhaust the host or other containers. The other options don’t form the foundation for container isolation. Kernel threading and sockets are general OS primitives and don’t by themselves create per-container isolation or resource limits. chroot offers only filesystem confinement and leaves many isolation gaps, making it insufficient for secure container isolation. Virtual machines and hypervisors provide full machine-level virtualization, which is a heavier, separate approach from the OS-level isolation Docker uses.

The main concept is that Docker relies on Linux kernel features that provide OS-level isolation: Namespaces and cgroups. Namespaces give each container its own isolated view of system resources such as the process list, mount points, network interfaces, IPC, and user IDs, so processes inside a container can’t see or affect processes or resources outside it. Cgroups, short for control groups, enforce limits and track usage of resources like CPU, memory, and I/O, ensuring a container can’t exhaust the host or other containers.

The other options don’t form the foundation for container isolation. Kernel threading and sockets are general OS primitives and don’t by themselves create per-container isolation or resource limits. chroot offers only filesystem confinement and leaves many isolation gaps, making it insufficient for secure container isolation. Virtual machines and hypervisors provide full machine-level virtualization, which is a heavier, separate approach from the OS-level isolation Docker uses.