You have been picturing docker as a tiny computer running inside your computer, isn't it? But honestly there is no box in there at all. So try this right now. Start any docker container then run ps command on your host machine. Not insert the container on the host itself and there it is. You will see that containers process sitting in your normal process list right next to your browser because that's all it ever was. A completely ordinary process. Linux just tell it 2 lies. The first one is called Namespace and it changes what the process can see. It looks around, find its own files, its own network, its own list of programs and concludes that as a whole machine. The second lie is C Group and that one changes what it can take. 2GB of memory, half a CPU. Not because it locked in anywhere but because somebody set a limit on it. kernel underneath as everything else you are running and that's why a container starts in a millisecond while a virtual machine has to boot a whole operating system first. So there was never a box to boot you are not shipping a tiny computer you are shipping a process wearing a blind else.
Machine-transcribed from the published render, so acronyms may be cased as ordinary words.