Developer Nick describes lessons from building a container runtime: Docker containers are constrained host processes, not separate virtual machines. Namespaces separate visible resources, cgroups limit usage, and a directory prepared from the image becomes the process’s root filesystem. runc uses C code for necessary namespace initialization before the Go runtime creates threads. The article’s discussion of root privileges concerns common default configurations. Docker’s official documentation also describes rootless mode, which runs both the daemon and containers without root privileges inside a user namespace.