Container Isolation Security

A container is five namespaces, a root filesystem swap, and two writes to cgroupfs

A walkthrough builds one with unshare, chroot and an Alpine tarball, no daemon involved. The useful part is what it tells you the day Docker is not on the box and root is.