1

I've been doing some research on Linux and networks in general, and came across namespaces. After reading articles and learning how to set one up, I am confused.

I installed an application on my system, and when I run it in the global namespace (no namespace), I can connect to the web gui from the lan using the host's IP address. Now, when I create a namespace, and before I create any virtual adapters or do anything else, if I open the application in the namespace, I can still connect to it from the LAN using the same IP.

The command I'm using to start the service is:

sudo ip netns exec blue service *application* start

My understanding is that "network" namespaces are supposed to isolate processes. So what am I missing?

By the way, I generally use these instructions for namespaces:

http://blog.scottlowe.org/2013/09/04/introducing-linux-network-namespaces/

  • What is the question? What have you tried? What results did you see that you didn't expect? – Stephen Rauch Jan 21 '17 at 7:01
  • Why isn't the application being isolated from the network interfaces? If I open the application inside a namespace without any type of network devices, virtual or physical, I shouldn't be able to access the application's web gui from another LAN computer, because that would mean the application is communicating through my eth0 card. However, I am still able to access the application's web gui. My question is where is my misunderstanding? – jeebs Jan 21 '17 at 7:07
5

So what am I missing?

What you're missing is that service communicates with init, essentially escaping the network namespace. The application ends up running in the same network namespace as the init system (by default).

At its core, the problem is that service doesn't just fork and exec the application daemon binary (which would preserve the namespace). Instead, it does little more than passing its parameters to init through (I believe) a Unix domain socket. Secure containers also isolate the filesystem to prevent this kind of thing.

I'd try just invoking the application daemon binary directly (under ip netns exec [namespace], of course). Or use a real container software where someone else has already sorted out all the tricky details ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.