How does it work?

• start with chroot,

• optional "security context" on processes

• isolation between "security contexts"

• resource limits to prevent systems being overrun

• resource sharing and balancing to make best use of hardware