What is used by the kernel to Isolate resources when running Docker containers?

Namespaces provide isolation for process IDs, network interfaces, mount points, and users, but cgroups are specifically responsible for resource limiting and accounting.

Overlay networks provide network connectivity and isolation between containers, potentially across multiple hosts, but they do not manage host-level compute resources like CPU or memory.

Volumes provide persistent storage for containers, allowing data to persist independently of the container's lifecycle, but they are not used for isolating compute resources.

Control Groups (cgroups) are a fundamental Linux kernel feature that allows Docker to limit, account for, and isolate resource usage (such as CPU, memory, and I/O) for containers, preventing one container from monopolizing host resources.