They seem pretty easy to understand to me. Mostly namespacing to hide things so that a container appears to be a separate instance of an OS. Hide the parent filesystem, process list, network interfaces, etc, so it "feels" like a separate instance of an operating system.

There's value in this, of course, but it isn't really complicated.