I just discovered that mount | grep cgroup returns nothing when you are not in the default network namespace. I can't really find any documentation on this except for that "network namespaces isolate the UNIX domain abstract socket namespace". That's in the man page for network namespaces.

Cgroups are mounted as type cgroup. Is this a socket? Is that why they are unaccessible from a network namespace?

This is quite a limitation, because I cannot run things like runc or any other program that uses cgroups in a specific network namespace.

Is there a way to work around this? Is this an intented feature? Documented anywhere?

  • How are you entering the network namespace? Are you sure it's not also entering other namespaces (eg mount namespace)? – Stephen Harris Jan 2 at 17:59
  • ip netns add otherns; ip netns exec otherns mount | grep cgroup. That's all. – bonanza Jan 2 at 18:28
  • A few other things are missing, debugfs, configfs pstore, sysfs, selinuxfs and securityfs – bonanza Jan 2 at 18:37
  • Aha, thanks for the hint. It seems that ip netns exec creates a mount namespace in order to give every namespace specific network configuration files. I suppose they do not propagate all mounts to this new namespace. Found it thanks to: stackoverflow.com/questions/45629002/… – bonanza Jan 2 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.