What makes a process a container to the kernel

WHAT IT TESTS: depth on how the kernel views a container. ANSWER OUTLINE: a container is an ordinary process that the kernel has decorated. Namespaces give it isolated views and cgroups cap its resources, but going further it also has a restricted capability set, a seccomp filter limiting syscalls, a pivoted root filesystem via mount namespace and pivot_root, and MAC labels from SELinux or AppArmor. It shares the host kernel; there is no separate OS. RED FLAG: stopping at namespaces and cgroups or implying a guest kernel like a VM.