How Linux Namespaces and cgroups Work: Isolation, Resource Limits, and Why a Container Is Not a Virtual Machine
A process that calls unshare(CLONE_NEWPID) and then fork does not get a private machine. It gets a private view of process IDs. The child se...