Please refer to how to encrypt your config and IAM credentials [here](https://github.com/minio/minio/blob/master/docs/kms/IAM.md).

> NOTE: if *path_prefix* is set then MinIO will not federate your buckets, namespaced IAM assets are assumed as isolated tenants, only buckets are considered globally unique but performing a lookup with a *bucket* which belongs to a different tenant will fail unlike federated setups where MinIO would port-forward and route the request to relevant cluster accordingly....

**Note**: this is a very technical detail that you probably can **just skip**.

---

The `APIRouter`s are not "mounted", they are not isolated from the rest of the application.

This is because we want to include their *path operations* in the OpenAPI schema and the user interfaces.

As we cannot just isolate them and "mount" them independently of the rest, the *path operations* are "cloned" (re-created), not included directly.

///

      return new ThrowingCreator();
    } catch (IllegalAccessException e) {
      // ditto
      return new ThrowingCreator();
    }

    // Android isolates apps' temporary directories since Jelly Bean:
    // https://github.com/google/guava/issues/4011#issuecomment-770020802
    // So we can create files there with any permissions and still get security from the isolation.

        System.setProperties(originalSystemProperties);
        resetHandlerState();
    }

    /**
     * Resets the static state of the Handler class using reflection.
     * This is crucial for ensuring that tests are isolated from each other.
     */
    private void resetHandlerState() throws Exception {
        // Reset the static factory field
        Field factoryField = Handler.class.getDeclaredField("factory");

        opCodeField.setAccessible(true);
        opCodeField.set(nameQueryResponse, 7); // WACK opCode, which is not QUERY (0)

        // Ensure 'resultCode' is 0 for this test to isolate opCode condition
        Field resultCodeField = NameServicePacket.class.getDeclaredField("resultCode");
        resultCodeField.setAccessible(true);
        resultCodeField.set(nameQueryResponse, 0);

</details>

## What is a Container { #what-is-a-container }

Containers (mainly Linux containers) are a very **lightweight** way to package applications including all their dependencies and necessary files while keeping them isolated from other containers (other applications or components) in the same system.

        GraphBuilder.from(graph).allowsSelfLoops(true).<N>immutable();
    // Every node is, at a minimum, reachable from itself. Since the resulting transitive closure
    // will have no isolated nodes, we can skip adding nodes explicitly and let putEdge() do it.

    if (graph.isDirected()) {
      // Note: works for both directed and undirected graphs, but we only use in the directed case.

        GraphBuilder.from(graph).allowsSelfLoops(true).<N>immutable();
    // Every node is, at a minimum, reachable from itself. Since the resulting transitive closure
    // will have no isolated nodes, we can skip adding nodes explicitly and let putEdge() do it.

    if (graph.isDirected()) {
      // Note: works for both directed and undirected graphs, but we only use in the directed case.

# Virtual Environments { #virtual-environments }

When you work in Python projects you probably should use a **virtual environment** (or a similar mechanism) to isolate the packages you install for each project.

/// info

If you already know about virtual environments, how to create them and use them, you might want to skip this section. 🤓

///

/// tip

A **virtual environment** is different than an **environment variable**.