The Stack Overflow podcast is back! Listen to an interview with our new CEO.
2 added 331 characters in body
source | link

So what am I missing?

What you're missing is that service communicates with init, essentially escaping the network namespace. The application ends up running in the same network namespace as the init system (by default).

At its core, the problem is that service doesn't just fork and exec the application daemon binary (which would preserve the namespace). Instead, it does little more than passing its parameters to init through (I believe) a Unix domain socket. Secure containers also isolate the filesystem to prevent this kind of thing.

I'd try just invoking the application daemon binary directly (under ip netns exec [namespace], of course). Or use a real container software where someone else has already sorted out all the tricky details ...

So what am I missing?

What you're missing is that service communicates with init, essentially escaping the network namespace. The application ends up running in the same network namespace as the init system (by default).

I'd try just invoking the application daemon binary directly (under ip netns exec [namespace], of course).

So what am I missing?

What you're missing is that service communicates with init, essentially escaping the network namespace. The application ends up running in the same network namespace as the init system (by default).

At its core, the problem is that service doesn't just fork and exec the application daemon binary (which would preserve the namespace). Instead, it does little more than passing its parameters to init through (I believe) a Unix domain socket. Secure containers also isolate the filesystem to prevent this kind of thing.

I'd try just invoking the application daemon binary directly (under ip netns exec [namespace], of course). Or use a real container software where someone else has already sorted out all the tricky details ...

1
source | link

So what am I missing?

What you're missing is that service communicates with init, essentially escaping the network namespace. The application ends up running in the same network namespace as the init system (by default).

I'd try just invoking the application daemon binary directly (under ip netns exec [namespace], of course).