There is limited visibility into the Linux environment. No root access is allowed, access is as  defined by Docker interfaces. Also, there is little Linux administrative overhead. The basic architecture for zCX is described in Figure 1-9. zCX runs as an address space on  z/OS that contains a Linux Kernel, Docker Engine, and the containers that can run within that  instance. Figure 1-9 zCX basic architecture Within the zCX address space is the z/OS Linux Virtualization Layer. This layer allows virtual  access to z/OS Storage and Networking. It uses the virtual interface to communicate with the  Linux kernel, which allows zCX to support unmodified, open source Linux on Z kernels. Linux storage and disk access is provided through z/OS owned and managed VSAM data  sets. This allows zCX to leverage the latest I/O enhancements (for example, zHyperLinks, I/O  fabric diagnostics, and so on), built-in host-based encryption, replication technologies, and  IBM HyperSwapfi. See Figure 1-10 for details.  10  Getting started with z/OS Container Extensions