In more detail
The container holds timestamps and creation data that forensic tools parse, such as MP4 atoms with their own epoch for creation time. The same codec can sit inside different containers, so identify both. See Codec. A container interleaves the audio, video and subtitle streams, and stores an index for seeking, chapter marks and Metadata. Common examples are MP4/MOV (built from "boxes" or atoms), Matroska/WebM (EBML elements), AVI, and for audio WAV, Ogg and M4A. Each starts with recognisable Magic bytes: MP4 has ftyp at offset 4, Matroska starts 1A 45 DF A3.
Why it matters
Renaming .mkv to .mp4 does not convert anything; the player still sees Matroska. Converting between containers can be lossless (re-wrapping), whereas changing the codec always re-encodes. Container timestamps use their own epochs, so a naive reading can be off by decades.
Example
The first bytes of an MP4 made with FFmpeg:
00000000: 0000 0020 6674 7970 6973 6f6d 0000 0200 ... ftypisom....
00000010: 6973 6f6d 6973 6f32 6176 6331 6d70 3431 isomiso2avc1mp41
The box is 0x20 = 32 bytes long, its type is ftyp and the major brand isom. Inside the mvhd box, creation time counts seconds since 1904-01-01: 2026-03-14 09:30:00 UTC is stored as 3,856,325,400 (0xE5DADB18), which is 2,082,844,800 seconds more than the Unix value.