Container permissions can be inherited from the system host*, individual hosts, or permissioned individually. If you are hosting a single host that all have the same administrators, then container permissions might be more easily managed by editing the container and using the permissions tab to distribute role/user access. However, a multiple-site implementation with various hosts that all need to be permissioned to differing roles/users will more easily be managed by setting up inheritance at the System Host/Host Level using the Roles manager.
To view the permissions set on a container, mouse over the Website Tab and click on Containers. Then right-click on the correct container title, then click "Edit". Now click on the Permissions tab next to the container Properties tab.
Container Permission Inheritance from System Host
Below is an image of a container that is inheriting all its permissions from the "System Host". This means that permissions on this container is inheriting permissions directly from the Role permissons themselves set at the System Host* level.
Setting Individual Permissions
While editing a container, clicking on the Permissions tab and the "Permission Individually" button will stop any role inheritance coming from higher up the permission hierarchy and allows for permissions to be set on the container itself.
*For more information on setting permissions on dotCMS objects from the System Host, please see the documentation on Role Permissions.