When I was digging into Container (a.k.a it uses linux namespace capabilities) lwn.net's series of article helps me a lot.

https://lwn.net/Articles/531114/#series_index