What are namespaces and cgroups, and what does each provide?

Namespaces provide isolation — each container gets its own view of PIDs, network interfaces, mount points, hostname, and IPC, so it can't see or interact with the host's or other containers' resources. Cgroups (control groups) provide resource limiting and accounting — capping how much CPU, memory, or I/O a container can consume. Namespaces answer 'what can I see', cgroups answer 'how much can I use'.