title: Does docker internally uses system calls like chroot, unshare, nsenter, etc or a wrapper around lxc
body: <p>I was going through an <a href="https://ericchiang.github.io/post/containers-from-scratch/" rel="nofollow noreferrer">article</a> to build containers from scratch without using docker just by making use of linux system calls like chroot, unshare, nsenter, etc.</p>
  
  <p>Does docker internally a wrapper around these system calls, it seems like docker exec is not using nsenter as per this <a href="https://stackoverflow.com/questions/27873312/docker-exec-versus-nsenter-any-gotchas">answer</a></p>
  
  <p>If docker is using these calls which golang binary is it using to have these system calls.</p>
  
  <p>Or docker is a wrapper around lxc but it don't seems to me as per this <a href="https://unix.stackexchange.com/questions/254956/what-is-the-difference-between-docker-lxd-and-lxc">answer</a></p>
  
  <p>Can anyone point me out the exact low level stuff (system calls/lxc,etc) that docker is currently using to build a container.</p>