Container, really? Kernel Mode Cgroups Namespaces Security Capabilities Scheduler Syscall task_struct … Scheduling Entity (se) “running” syscall.Exec(ENTRYPOINT/CMD)* A Structure in Kernel Memory. The Kernel has no Notion of a “Container”. It’s yet another Executable. User Mode Docker Engine ContainerCreate() * After Container Sandbox Initialization (nsenter.go/nsexec.c) sched_class fair.c (CFS) @embano1