Container

Removing a named handle does not free a network namespace while a process still holds it.

Network namespaces isolate networking; their names do not own every process

A Linux network namespace separates networking resources such as interfaces, routes, neighbor tables, socket ports, and packet-filter rules. It shares the kernel with other namespaces; it is not a separate operating system. A process normally inherits its parent’s network namespace, and tools can execute a process in another one. The resulting isolation covers networking resources, not every aspect of process identity or filesystem access. ...

Default arguments reach an executable, while wrapper process structure determines which process receives the stop signal.

ENTRYPOINT and CMD define defaults that operators can override

An image’s ENTRYPOINT and CMD contribute to the command used when a container is created. With an exec-form ENTRYPOINT, CMD commonly supplies default arguments appended to that entrypoint. Without an entrypoint, CMD can supply the executable and its arguments. These are startup defaults, not an enforcement boundary: an authorized operator can replace the entrypoint or arguments when creating a container. ...

A whiteout hides an earlier file from the merged view while its original layer still contains the bytes.

Deleting a file in a later image layer does not erase its bytes

Container image layers describe filesystem changes applied in order. A layer can add or replace a file, or record that an earlier path should disappear from the merged filesystem. That final view is what a normal container process sees, but it is not the complete history of bytes distributed with the image. Inspecting only the running container can therefore miss data retained in earlier layers. ...