I'm a bit lost. I was under the impression that Docker (and containerisation in general) works based on kernel namespaces, which, IIUC, is a way to instantiating distinct subsystems in the kernel, on demand. What does hardware support for virtualization have to do with it? I mean, for VMWare or VirtuaBox, yes, I can imagine; but does that matter for Docker? Can someone explain?