Complete a basic container vessels need to do six isolation:
Linux kernel will provide the six namespace (namespace) isolation system calls
Namespace system call arguments isolate content
1, UTS CLONE_NEWUTS host name and domain name
2, IPC CLONE_NEWIPC semaphores, shared memory
3, PID CLONE_NEWPID process number
4, Network CLONE_NEWNET network equipment
5, Mount CLONE_NEWNS mount point, file system
6, User CLONE_NEWUSER users and user groups
Isolation of a command:
unshare
1, host or domain isolation
unshare --uts
2, file systems, and user isolation
unshare --mount
3, semaphores and isolation process ID
unshare --pid --ipc --fork --mount-proc /bin/bash
4, network isolation
unshare --net /bin/bash