tl;dr: Containers aren't a single Linux feature but a combination of five (namespaces, cgroups, networking, chroot/pivot_root, etc.), and images are essentially just folders that Docker chroots into. Go is a surprisingly awkward choice for runc since many container-related syscalls require a single-threaded context, forcing runc to use a C module before Go's runtime starts and to re-exec /proc/self/exe to fake fork. Docker also traditionally requires root, and rootless setups must reimplement networking in userspace.