“Unlike VMs, containers are just processes with special restrictions on them.”
Five kernel features in a trenchcoat. Most developers never see that because Docker on a Mac quietly runs a Linux VM. The tool that made infrastructure “simple” depends on runc faking a fork in a language that can’t fork. Rootless networking is still a userspace reimplementation.