Lizzie Dixon’s 2016 literate-C walkthrough builds a tiny container runner to show what isolation actually requires. The title’s 500 lines are approximate—the code grew after publication—and the example targets Linux 4.7/4.8, so this is an explanation of mechanisms, not a modern sandbox recipe.

The isolation layers solve different problems:

  • Namespaces separate the child’s view of processes, mounts, networking, IPC, and hostname.
  • A bind mount plus pivot_root replaces the filesystem view; unmounting the old root matters.
  • Capabilities limit root powers, but the bounding and inheritable sets matter because execve can restore privileges.
  • Seccomp narrows syscalls; cgroups and setrlimit constrain resource use, including runaway process creation.

The lesson is that a container is a composition of boundaries, not a magic property conferred by clone. Dixon is explicit that a minimal restriction set is for learning; for exposed systems, restrict everything you can and use current, maintained isolation tooling.