A computing system comprising: one or more processors; memory; a storage unit comprising a container namespace (112..112) associated with a container defined within the computing system, the container having exclusive access to files stored within the container namespace; a file system executing on the one or more processors; and a namespace virtualization component comprising computer-executable instructions stored in the memory which, when executed by the one or more processors, performs operations comprising: receiving from an application executing on the one or more processors an input/output (I/O) call requesting an operation on a file, the received I/O call including a directory path of the file within a first directory hierarchy that is projected into the namespace of the container, the first directory hierarchy having a first root directory; mapping (958, 960) the directory path of the file within the first directory hierarchy to a target directory path of a second directory hierarchy within the container namespace based on a table that associates each of a plurality of directory paths of the first directory hierarchy to a corresponding target directory path of the second directory hierarchy and indicates, for each association of a directory path of the first directory hierarchy with a corresponding target directory path of the second hierarchy, whether the target directory path is to be hidden from the application from which the I/O call was received, the target directory path of the second directory hierarchy corresponding to a scratch layer of the second directory hierarchy; replacing (964, 968) the directory path of the file in the I/O call with the target directory path based on the mapping; and passing (966, 970) the I/O call including the target directory path for the file to the file system of the computing system. one or more processors; memory; a storage unit comprising a container namespace (112..112) associated with a container defined within the computing system, the container having exclusive access to files stored within the container namespace; a file system executing on the one or more processors; and a namespace virtualization component comprising computer-executable instructions stored in the memory which, when executed by the one or more processors, performs operations comprising: receiving from an application executing on the one or more processors an input/output (I/O) call requesting an operation on a file, the received I/O call including a directory path of the file within a first directory hierarchy that is projected into the namespace of the container, the first directory hierarchy having a first root directory; mapping (958, 960) the directory path of the file within the first directory hierarchy to a target directory path of a second directory hierarchy within the container namespace based on a table that associates each of a plurality of directory paths of the first directory hierarchy to a corresponding target directory path of the second directory hierarchy and indicates, for each association of a directory path of the first directory hierarchy with a corresponding target directory path of the second hierarchy, whether the target directory path is to be hidden from the application from which the I/O call was received, the target directory path of the second directory hierarchy corresponding to a scratch layer of the second directory hierarchy; replacing (964, 968) the directory path of the file in the I/O call with the target directory path based on the mapping; and passing (966, 970) the I/O call including the target directory path for the file to the file system of the computing system. receiving from an application executing on the one or more processors an input/output (I/O) call requesting an operation on a file, the received I/O call including a directory path of the file within a first directory hierarchy that is projected into the namespace of the container, the first directory hierarchy having a first root directory; mapping (958, 960) the directory path of the file within the first directory hierarchy to a target directory path of a second directory hierarchy within the container namespace based on a table that associates each of a plurality of directory paths of the first directory hierarchy to a corresponding target directory path of the second directory hierarchy and indicates, for each association of a directory path of the first directory hierarchy with a corresponding target directory path of the second hierarchy, whether the target directory path is to be hidden from the application from which the I/O call was received, the target directory path of the second directory hierarchy corresponding to a scratch layer of the second directory hierarchy; replacing (964, 968) the directory path of the file in the I/O call with the target directory path based on the mapping; and passing (966, 970) the I/O call including the target directory path for the file to the file system of the computing system.