1

I am a little confused about what --mount-proc does when used with unshare command.

When I use unshare -fp --mount-proc bash, I notice that it results in both a new PID namespace and a new MNT namespace.

Given that I am in a new MNT namespace, I tried unmounting one of the loop devices and noticed that this was not reflected in the parent MNT (the mount still shows when I run df -h in the parent namespace).

Now, I went one step ahead, and, from within the new MNT namespace created a new root using pivot_root, and unmounted the original root. As expected, the new namespace now has a different root. The parent namespace still has the original root directory.

My Question: If I can achieve creating a new MNT namespace without using the -m option in the unshare command, and also achieve creating an isolated root directory for the new process, what different purpose does the MNT namespace serve?

I would be grateful for any guidance from the experts.

EDIT: I have modified my original post, which said that changing the root in the new namespace also changes the root in the parent namespace. I am no longer able to reproduce this. But my question on being able to create a new MNT namespace with just the --mount-proc option and without using -m with unshare still remains.

0

1 Answer 1

1

man unshare’s description of --mount-proc mentions

It also implies creating a new mount namespace since the /proc mount would otherwise mess up existing programs on the system.

So in effect --mount-proc implies -m, with all the consequences you’ve seen. This isn’t something different, it is a new, private, mount namespace.

The -m option is still useful on its own since a new mount namespace can be useful without /proc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.