I can't remember exactly what all the pieces are. However, I believe its a combination of

• cgroups: process isolation which is why you can see docker processes in ps/top/etc but you can't for vms. I believe this is also what gets you the ability to run cross distro images since the isolation ensures the correct shared objects are loaded
• network namespaces: how they handle generating the isolated network stack per process
• some additional mount magic that I don't know what its called.

My understanding is that all of the neat properties of docker are actuall part of the kernel, docker (and podman and other container runtimes) are mostly just packing them together to achieve the desired properties of "containers".