Containers are not magic. They are two kernel features, namespaces and cgroups, wrapped by a runtime. Understanding them makes container debugging far easier.