I know this is pedantic but I run `man namespaces`, I see

> 
> A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource. Changes to the global resource are visible to other processes that are members of the namespace, but are invisible to other processes. **One use of namespaces is to implement containers.**
> 
> 
> 

When it says "to implement *containers*", what do I need beyond namespace isolation to call what I'm doing a "container"? Alternatively, and more specifically, if I run `unshare` to a launch a program in a different user namespace is that a "container"?