Creates isolated processes, memory, mount points, and networking for containers.