Questions tagged [namespace]
Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.
265
questions
-1
votes
0
answers
29
views
BSD namespace existence
Does BSD (Free/Net/Open etc.) have namespace implementation in their kernel (like in Linux). Because I did not find any clear explanation on internet.
- 1
0
votes
0
answers
25
views
NVMe device on my RHEL8 system corrupt?
It seems that the single namespace that was on my NVMe PCIe device is completely gone. I received an email alert from my system which just said:
Device: /dev/nvme0, unable to open NVMe device
When I ...
2
votes
1
answer
34
views
Root network namespace as transit between 2 other net namespaces
I am trying to communicate between two network namespaces that are connected through the root namespaces using veth pairs as seen in the diagram. I am unable to perform a ping from netns A to netns B. ...
1
vote
0
answers
65
views
How to firewall a network namespace using firewalld?
I'm running fedora 36 using firewalld as my firewall.
I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this:
ip ...
3
votes
0
answers
104
views
Use Public IPv4 on Linux Network Namespace
I am using a VPS and gotten an extra IP address. I am trying and failing to assign the second IP address to a separate network namespace.
Lets say my main IP and netmask is x.x.133.39/23 and my ...
- 31
0
votes
1
answer
118
views
systemd service timeout when using sudo
Target
I am trying to run a service (transmission-daemon) in a network namespace for VPN usage. The service should automatically start using systemd.
Implementation details
I am using namespaced-...
- 1
2
votes
1
answer
88
views
Unable to get a namespace to access the external network
I am running Linux in a VirtualBox environment. I have successfully defined 2 namespaces connected via a bridge that can talk to each other. I want to be able to get UDP packets out onto the actual ...
- 121
0
votes
0
answers
151
views
How to get NVME disk back after deleting all namespace?
I want to change the size of namespace, use the command:
nvme delete-ns XXXXXX -n 1
For some reason, I reboot the computer without create any namespace, after that I can't find the nvme drive.
root@...
- 1
1
vote
0
answers
191
views
Explanation of details in SOURCE column of findmnt
I have some questions regarding the output of the "findmnt" command, specifically the SOURCE column:
TARGET SOURCE FSTYPE ...
- 11
0
votes
0
answers
112
views
Forward traffic from public IP to namespace
I have two VMs VM-A & VM-B connected via IPIP Tunnel in a namespace. I want the application in VM-B which is under namespace to be accessed from the public IP of VM-C. Can someone help me how can ...
- 358
4
votes
1
answer
462
views
What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?
While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
- 131
0
votes
1
answer
57
views
Fix Polyinstantiation of /tmp causing 'connect /tmp/.X11-unix/X0: No such file or directory'
In a multiseat desktop system with the /tmp directory polyinstantiated, the /tmp/.X11-unix/ directory and Xn instances are still created under root's /tmp not a user's.
ssh -Ying into or out of the ...
- 534
1
vote
1
answer
465
views
Why is my namespace not detected?
I tried form home,then sudo su -
ip netns exec 5bd337503b01 ip addr show
Cannot open network namespace "5bd337503b01": No such file or directory
pwd shows
/var/run/docker/netns
Why?
- 311
0
votes
0
answers
154
views
Mount FUSE inside user namespace
Since Linux 4.11, mounting with FUSE inside user namespaces should be possible. However, unshare -r unionfs -o allow_other,allow_root hi=RW merged does not work (hi and merged are empty folders) with ...
0
votes
0
answers
109
views
Getting NVMe namespace size as 0 always?
I have sending nvme namespace identify command to get size of device but getting 0 always.
#define IDENTIFY_LEN 0x1000
#define NAMESPACE_ID 1
int main(int argc, char* argv[]){
if(argc < 2){
...
0
votes
0
answers
31
views
Why is the default NameSpace of pid always 4026531836 [duplicate]
Why is the default NameSpace of pid always 4026531836.
Whats special about this number?
- 215
4
votes
1
answer
459
views
How do you get the child pid of `unshare` when using --fork for `nsenter -t <pid>`?
When using unshare --pid --fork, the nsenter command must attach to the child pid not the unshare pid to get to the right pid namespace.
I can get unshare's pid as follows:
unshare --pid --mount --...
- 273
2
votes
2
answers
354
views
Why is the Linux command `unshare --pid=p --mount=m` not creating a persistent namespace?
From everything I have read in the unshare and nsenter man pages, I should be able to bind-mount a directory to itself, mount --make-private the directory, and then use files within that directory to ...
- 273
1
vote
1
answer
92
views
If ports are unpriviledged, why can't I access them if I am root in a namespace?
I've run sudo sysctl -w net.ipv4.ip_unprivileged_port_start=1. However, sudo ip netns exec myvpn unshare -r python -m http.server -b 127.0.0.1 2 does not work. Strangely enough, this does: sudo ip ...
8
votes
1
answer
597
views
How does /proc interact with PID namespaces?
I do not understand how namespaces interact with /proc. I assumed that /proc returns values based on the process that queries them.
For example, let's determine the PID of the current process inside ...
- 258
0
votes
1
answer
247
views
How to login to a user namespace created by unshare?
How to login to a user namespace created by unshare -U from another terminal?
- 219
-1
votes
1
answer
181
views
Dockers create user namespaces?
My question is about how Docker instrument the storage for the container instance.
Do container applications or Docker create user namespaces when creating a new container instance?
- 219
-2
votes
1
answer
315
views
How to create a user namespace in Ubuntu?
I want to create namespaces with and without the privilege and need to study the implications if the namespace creation is restricted only for the privileged users.
How to create a user namespace in ...
- 219
0
votes
0
answers
95
views
How to expand the number of subuids for a linux namespace
After running something like this:
$ unshare -rUm
$ mkdir opt
$ mount --bind opt /opt
$ touch /opt/test
$ chown 1000:1000 /opt/test
I'm receiving this:
chown: changing ownership of '/opt/test': ...
- 1
1
vote
0
answers
43
views
How to mount folders on a per-process basis while keeping all functionalities of regular shell
In order to fake a FHS OS on a non-FHS OS (NixOs) and to increase "purity", I need to mount some folders and overlay other folders in a per-process basis, for instance /lib does not exists ...
- 3,146
0
votes
0
answers
562
views
How do I start a Docker container in custom network namespace?
How do I make docker run to setns to the network namespace of my choice when starting a container? I want something like --net host mode, but aiming to the namespace of Docker server itself.
Or should ...
- 5,438
1
vote
1
answer
439
views
Unshare with overlayfs results in permission denied with su
I am trying to setup 'rootless' containers by hand, with just unshare and
mounting overlayfs. Currently, I can unpack a rootfs tarball, setup a /tmp
and /proc mount, and pivot_root/chroot into it ...
- 757
1
vote
0
answers
108
views
Display and follow mount namespace tree peer group IDs
Linux has mount namespaces for process-scoped mount trees via the "shared subtrees" feature.
When you examine /proc/$pid/mountinfo of processes in a parent/child mount namespace, you can see ...
- 327
1
vote
1
answer
590
views
echo to gid_map fails but uid_map success
I'm trying to map the user and group ids in new namespace by writing to uid_map and gid_map files.
So on terminal-1 I'm doing
vaibhav@vaibhav:~$ unshare -U /bin/sh
$ id
uid=65534(nobody) gid=65534(...
- 108
3
votes
1
answer
724
views
IPv6 forwarding doesn't work in a network namespace
I have 3 Linux VMs connected like this:
/ server1 \
| ens19 2001:1::2 |
\ /
|
/ \
| ens19 2001:1::1 |
| ...
- 33
4
votes
2
answers
10k
views
Podman errors on tar with potentially insufficient UIDs or GIDs available in user namespace
When I run podman run I'm getting a particularly weird error,
❯ podman run -ti --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher:latest
✔ docker.io/rancher/rancher:latest
Trying to pull ...
- 26.9k
1
vote
0
answers
157
views
Real-Time Priority in the user namespace
I have a small program starting a thread with realtime priority in a user-namespace. But every time I want to start it, I get an errno "Permission denied". The program:
#include <stdio.h&...
- 11
0
votes
1
answer
492
views
Can't access directory from netns
I created a simple test netns :
sudo ip netns add test
Then I brought up the lo interface.
I'm currently in the home directory of user1, and by executing
sudo ip netns exec test ls -la
I see all the ...
- 1
2
votes
2
answers
296
views
Is cgroup a type of namespace?
Is cgroup a type of namespace?
I am asking this because I have seen blogs talking as if cgroup and namespaces are different. However, in different linux commands , cgroup is considered as a type of ...
- 2,284
2
votes
1
answer
988
views
How can I use a bind mount in a network namespace?
I have an app I run in a network namespace. This works well.
I want to run the app multiple times, in different namespaces. For convenience, I want to bind mount the app's working directory to ...
- 185
1
vote
1
answer
134
views
pivot_root() in user namespace fails with EINVAL
I want to isolate a potentially dangerous process, without needing root privileges.
However, the syscall pivot_root fails with EINVAL.
struct clone_args ca = {
.flags = CLONE_NEWUSER | CLONE_NEWNS,...
- 11
2
votes
2
answers
1k
views
Is it possible to access a Unix socket over the network?
The documentation of the Linux sandboxing application firejail says
whenever we are dealing with X11 we also need to install a new network namespace. This is the only way to block access to the ...
- 253
0
votes
0
answers
42
views
Is there a way to create a namespace to be able to unmount root folder (to uncover early boot environment)?
I'm on a quest to access /cow/upper when Linux is booted from liveUSB
$ mount | grep over
/cow on / type overlay (rw,relatime,lowerdir=filesystem.squashfs,upperdir=/cow/upper,workdir=/cow/work)
...
- 1,009
-1
votes
1
answer
1k
views
How to block the internet access but allow local host connection in a process
I have a python program with 2 process running in docker:
my own server listening at 8080
an application listening at 8000
I am trying to block the internet access for the 2nd process. I was able to ...
- 11
0
votes
2
answers
153
views
How to list open internet connections in a firejail?
I'm using firejail to sandbox firefox. When I use lsof -i, there are no connections shown. Firejail does namespace isolation on the process, so i do this
ps aux | grep firefox | awk ' { print $2} ' | ...
- 691
1
vote
0
answers
121
views
How do I report the max RSS of a cgroup?
I would like to monitor the peak RSS a cgroup has used since it was created.
By "peak RSS" I mean: the sum of all processes' RSS at the point in time where that sum is the greatest.
I ...
1
vote
1
answer
900
views
Unshare with --mount-proc creates a new mnt namespace
I am a little confused about what --mount-proc does when used with unshare command.
When I use unshare -fp --mount-proc bash, I notice that it results in both a new PID namespace and a new MNT ...
- 23
3
votes
1
answer
1k
views
why non root user cannot unshare pid namespace?
unshare -pf bash fails with operation not permitted without effective root. If I don't mount proc, mount ns is not needed. Is there any particular reason creating pid ns is not allowed?
- 31
2
votes
0
answers
72
views
Problem with ksh namespaces defined inside functions
I'm new to ksh namespaces. The problem I'm seeing is that if I define a namespace inside a function, then variables defined within that namespace clobber the same-named variables outside the namespace ...
- 21
4
votes
0
answers
350
views
How one can limit a user to a specific network namespace?
Suppose I have a Linux host with a few non-default network namespaces. I need to limit a specific user to a specific network namespace based on the results of user authentication. For example:
user1 ...
1
vote
1
answer
1k
views
How to move interface into nonstandard network namespace as unprivileged user
I have a Linux network namespace bind mounted at ~/mynamespace as follows:
unshare -mrn;
touch ~/mynamespace; # executed in the console opened by the first command
unshare --net=~/mynamespace true; # ...
- 25
0
votes
1
answer
286
views
Can't get sound to work in namespace
I am trying to get sound to work in a linux network namespace
(+) Audio --aid=1 (mp3 2ch 44100Hz)
ALSA lib pcm_dmix.c:1090:(snd_pcm_dmix_open) unable to open slave
[ao/alsa] Playback open error: No ...
- 101
2
votes
1
answer
277
views
In a user namespace as non-root, on a nosuid,nodev filesystem, why does a bind mount succeed but a remount fails?
In a Linux user namespace, as non-root, I bind mount /tmp/foo to itself. This succeeds.
Then, I try to remount /tmp/foo to be read-only. If /tmp is mounted with nosuid or nodev, then the remount ...
- 1,481
0
votes
1
answer
362
views
Forward only LAN traffic from network namespace to root namespace
I set up my machine going by the tutorial here to make a Wireguard interface the only interface (so any of my applications can only use that to access the internet).
This works as intended, but now I ...
- 1
1
vote
2
answers
144
views
Does linux have a single parent root file system?
I was reading up on this and my initial (incorrect) thought was that it was to do with mount namespaces and chroot.
It got me wondering... I know that if no process exists with access to a file ...
- 165