What are the default kernel parameters, when creating a new network namespace? Is there a way to override them upon creation?

I think they are inherited by the parent process. An example using unshare:

> /sbin/sysctl -a --pattern 'net.ipv4.conf.all.forwarding'
net.ipv4.conf.all.forwarding = 1
> unshare -n
> /sbin/sysctl -a --pattern 'net.ipv4.conf.all.forwarding'
net.ipv4.conf.all.forwarding = 1
  • 1) I think your answer has good evidence. 2) This seems similar to how fork() just clones a process, then you have to apply any changes you want to make to the clone as normal. Why wouldn't using sysctl --load satisfy your question? – sourcejedi Mar 21 '17 at 13:29
  • @sourcejedi Yes I could use sysctl --load. I was wondering if there was a way to do it in one step. – Dimitris Dalianis Mar 21 '17 at 16:15

I think your surmise is correct, they are inherited from the parent namespace. This seems similar to how processes clone themselves using the fork() system call, then any desired changes have to be applied by the clone, using the normal system calls. (Including replacing the current program with a completely different one, using exec(). fork()+exec() being how e.g. the shell runs other programs, although this magic is not usually visible to the user).

None of the options to the underlying unshare system call change this. So I'd say the answer to your question is no.


Oh... that wasn't even an analogy! Look at the option flags:

CLONE_NEWNET (since Linux 2.6.24)

This flag has the same effect as the clone(2) CLONE_NEWNET flag. Unshare the network namespace, so that the calling process is moved into a new network namespace which is not shared with any previously existing process. Use of CLONE_NEWNET requires the CAP_SYS_ADMIN capability.

clone() basically means fork().

Since version 2.3.3, rather than invoking the kernel's fork() system call, the glibc fork() wrapper that is provided as part of the NPTL threading implementation invokes clone(2) with flags that provide the same effect as the traditional system call. (A call to fork() is equivalent to a call to clone(2) specifying flags as just SIGCHLD.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.