Namespace

A namespace gives a process a private view of one kind of resource, such as its own process IDs, network stack, mount table, hostname, or user IDs.

A namespace limits what a process can see, and a cgroup limits what a process can use. Each namespace covers one kind of resource: process IDs, the network stack, the mount table, the hostname, or user IDs. A process inside a set of namespaces sees only its own process tree, its own network stack, and its own mount points.