View/manipulate mount namespaces in Linux

Question

Is there any way to view or manipulate the mount namespace for an arbitrary process?

For example, a docker container is running which has a local mount to an NFS server. It can be seen from inside the container, but on the outside, the host has no knowledge of it. With network namespaces this is doable. e.g. pipework

However, I see nothing about this for mount namespaces. Is there an API or sysfs layer exposed to view these mounts and manipulate or create new ones?

Answer 1

Yes. You can look at its /proc/$PID/mountinfo or else you can use the findmnt -N switch - about which findmnt --help says:

• -N, --task <tid>
  • use alternative namespace (/proc/<tid>/mountinfo file)

findmnt also tracks the PROPAGATION flag which is a mountinfo field which reports on exactly this information - which processes share which mounts.

Also, you can always nsenter any type of namespace you like - provided you have the correct permissions, of course.

 nsenter --help
Usage:
 nsenter [options] <program> [args...]

Options:
 -t, --target <pid>     target process to get namespaces from
 -m, --mount [=<file>]  enter mount namespace
 -u, --uts   [=<file>]  enter UTS namespace (hostname etc)
 -i, --ipc   [=<file>]  enter System V IPC namespace
 -n, --net   [=<file>]  enter network namespace
 -p, --pid   [=<file>]  enter pid namespace
 -U, --user  [=<file>]  enter user namespace
 -S, --setuid <uid>     set uid in user namespace
 -G, --setgid <gid>     set gid in user namespace
 -r, --root  [=<dir>]   set the root directory
 -w, --wd    [=<dir>]   set the working directory
 -F, --no-fork          do not fork before exec'ing <program>

 -h, --help     display this help and exit
 -V, --version  output version information and exit

For more details see nsenter(1).

Answer 2

The kernel also provides an easy direct access for the specific case of the mount namespace of a given pid/tid: /proc/<pid>/root/.

This is a link to the root ( / ) directory of that process, including all the mount points (it appears as a symlink to / but really resolves to the process' /, like are behaving symlinks of deleted files in /proc/<pid>/fd/).

This is handy for example to copy a file between host and/or containers when those containers have no available environment and command (eg: no shell) to do so. This wouldn't be possible when using nsenter, at least not without a specialized software not relying on fork/exec later.