By other I mean to say that I ran into the command: nsenter and have been thinking that there might be other tools/commands geared to working with and debugging namespaces. Are there? Keep in mind I'm not asking how they work, just looking to get a broader set of tools for working with docker/k8s, etc.

What other namespace oriented linux commands are there?

  • 1
    cgroups tag why? namespaces and cgroups are two different things.
    – sourcejedi
    Mar 7 '19 at 16:54
  • Hmm, I guess I've always considered them highly-related. My mistake.
    – lucidquiet
    Mar 10 '19 at 0:18

[Are there] other tools/commands geared to working with and debugging namespaces ?

nsenter is the most important one. There are some more, but not very many. I think I can usefully attempt to list them all.

  1. /proc/[pid]/ns/* - You already know about this, because you looked at nsenter. There are a couple more specifics in namespaces(7) :
    • The above files appear as symbolic links. Running readlink / ls -l will show the namespace type, and a unique identifier.
    • You can keep a permanent reference to a namespace by bind-mounting the above files. If you think this sounds a bit weird, I agree with you, but it can be useful in some cases :-).
  2. lsns - It crawls /proc for you, and lists all the different namespaces that are being used.
  3. /proc/[pid]/mountinfo describes the mount namespace. It is documented in proc(5).

    Take care the first time you look at it, because there are many columns. For example, there are two different "options" columns with potentially differing values for rw / ro. The difference is that the column for "mount options" can vary between bind-mounts of the same filesystem.

    findmnt is the standard command to list mounted filesystems. It has an option --task TID - so you can use it to parse the mountinfo file of any process. (A PID value is also a valid TID).

  4. /proc/[pid]/uid_map and /proc/[pid]/gid_map, for user_namespaces.

  5. The ip command used to control network interfaces:
    • ip netns provides some commands for network namespaces specifically. I.e. it just uses the net file in /proc/[pid]/ns/ as described above.
    • ip link can show information about veth peers, including a local identifier for the netns the peer is in. ip netns list-id or lsns -t net will list network namespaces including this local identifier. I'm not exactly sure how you work with these local identifiers, it seems a bit obscure. But I think this QA mentions everything you can do with them: How to find the network namespace of a veth peer ifindex?
    • ip also lets you move an interface from one netns to another. Although that's not so much about debugging.

"I’m looking at you, single binary go containers"

Adapted from How-to Debug a Running Docker Container from a Separate Container :

There is a problem with using nsenter. If you enter the mount namespace of a container, you can only run commands that were included in the container. But the point of Docker containers is that they only need to include the application itself!

The trick is that you can access the files inside the container, using /proc/[pid]/root/. (Documented in proc(5)).

This is very convenient if you have entered the PID namespace of a container, because you can use /proc/1/root/. At that point, you don't have to search for the right PID :-).

Having entered the PID namespace, it could also be quite convenient if you know the process you want to attach a debugger to will be PID 1 (or perhaps PID 2) inside the container :-). Alternatively, if your application/container is multi-process, you can use your favourite ps command to look at the different processes.

  • Probably unshare also deserves mentioning... Mar 9 '19 at 22:27
  • @DanilaKiver or maybe get the question clarified as extending beyond "working with docker/k8s, etc" :-P. If I can add only unshare then I agree, but I'm not sure. I treated this as an exercise in showing how little more there is to know, at least about the low-level primitives :-).
    – sourcejedi
    Mar 9 '19 at 23:04
  • @DanilaKiver if you want to inspect a container namespace, you enter the namespace and use the usual system calls. That's almost all you can do.
    – sourcejedi
    Mar 9 '19 at 23:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.