What even is a container: namespaces and cgroups