A Docker container is a Linux sandbox that isolates processes using kernel features like namespaces and cgroups, allowing them to run directly on the host kernel with a restricted view of the system. Unlike virtual machines, containers share the host kernel and boot instantly with minimal memory overhead. Containers require a Linux VM to run on macOS and Windows since those kernels lack the necessary isolation mechanisms.
Kubernetes v1.37 promotes KubeletInUserNamespace (rootless mode) to beta, allowing node components to run as non-root users in Linux user namespaces. This feature mitigates container-breakout vulnerabilities and enables secure multi-tenant deployments on shared machines, laptops, and nested clusters.