Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

0
votes
0answers
17 views

User namespace error - /dev/pts mode change

I am doing a simple test on user namespace on Ubuntu 16.04 as shown below. root@PC:/# root@PC:/# unshare --user --map-root-user mesg: change /dev/pts/2 mode failed: Operation not permitted root@PC:/#...
0
votes
0answers
39 views

unshare system call c code linux namespaces [on hold]

In Ubuntu 16 kernel 4.15 this work in console: root@ubuntu:~# unshare --mount-proc --pid --fork root@ubuntu:~# umount /proc root@ubuntu:~# mount -t proc proc /proc root@ubuntu:~# ls /proc (I see ...
0
votes
0answers
81 views

execve(2) not launching system commands

I am trying to implement a container, and for that I create a process using the clone(2) system call with the appropriate flags: if ((child_pid = clone(child_main, process_struct.Stack + ...
1
vote
1answer
34 views

error creating namespaces

I am trying to create a process with new namespaces, and for that i need to use clone(2) with the appropriate flags, the following is the clone system call and a printf() statement to print the parent ...
1
vote
1answer
48 views

Sound is not detected in a namespace

I created a namespace and ran a terminal like that: ip netns exec <namespace> gnome-terminal As by default namespace are handled in root, when I open the terminal I change to my normal user: ...
2
votes
1answer
47 views

About mounting and umounting inherited mounts inside a newly-created mount namespace

Experiment 1 From outside the namespace, cat /proc/self/mountinfo gives 291 34 0:37 / /tmp/IMJUSTTMP rw,relatime shared:152 - tmpfs tmpfs rw,size=102400k 34 23 0:32 / /tmp rw,nosuid,nodev shared:16 -...
3
votes
1answer
51 views

Why can I not bind a mount namespace to a file

I observe the following: As unprivileged user in shell No 1: user@box:~$ sysctl kernel.unprivileged_userns_clone kernel.unprivileged_userns_clone = 1 user@box:~$ unshare --mount --user nobody@box:~$ ...
1
vote
0answers
35 views

Running su inside mount namespace

I am testing mount namespace using the following steps: # unshare --mount # mount --bind rootfs/ ns_dir/ # cd ns_dir/ # pivot_root . . # cd / My rootfs has sub-folders /lib, /bin, /etc. I have put ...
0
votes
1answer
26 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
0
votes
0answers
30 views

Can two threads in the same process belong to different namespaces?

The task_struct structure has an entry nsproxy which points to namespaces associated with the task_struct. My understanding is that task_struct can be used to represent both process and threads in ...
1
vote
1answer
41 views

Namespace numbers in /proc

I am checking the namespaces associated with a shell process as follows: # ll /proc/$$/ns total 0 dr-x--x--x 2 root root 0 May 2 15:10 ./ dr-xr-xr-x 9 root root 0 May 1 18:39 ../ lrwxrwxrwx 1 root ...
1
vote
1answer
68 views

Invalid arguments when mounting with MS_SHARED

I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount ...
2
votes
0answers
51 views

Restrictions on pivot_root to switch root filesystem

This question is a follow up to the question I asked on how LXC setups up its root mount point. For a container named testcontainer, LXC uses bind mount to mount /var/lib/lxc/testcontainer/rootfs to /...
0
votes
1answer
45 views

Why are Linux namespace links in /proc red in color?

I inspected the symlinks in an Ubuntu VM for the namespace related directories under /proc/PID/ns. I see all the links are in red color. I even tried to test using unshare to see if I can create a ...
2
votes
1answer
71 views

How does LXC setup its root mount point?

I am trying to experiment with mount namespace in Ubuntu. So far I can create an empty mount namespace using the following: # mkdir test # unshare --mount # mount none test -t tmpfs # cd test # ...
0
votes
1answer
24 views

Why does unshare binary call clone() so many times?

I am trying to test the unshare command in Linux. I am using it to create a new user namespace. I tried the following test: user1@myPC$ strace -e clone,unshare,fork,execve unshare --user execve("/usr/...
3
votes
0answers
44 views

Is linux mount propagation asynchronous to the mount call?

I have two processes in different mount namespaces. They have a shared directory bind mounted to /mnt/share. The "master" uses MS_SHARED propagation for the mount, while the "slave" uses MS_SLAVE. ...
0
votes
0answers
54 views

Using socat to access deluge daemon in a different namespace

I'm using namespaced-openvpn to ensure that my torrent traffic in deluge is always behind a VPN. A modified script from this blog post helped to connect the VPN namespace to the real network: ip ...
-1
votes
1answer
37 views

Does chroot need any special kernel support?

docker is said to be a steroid version of chroot. Does chroot need any special kernel support, e.g. namespace, cgroup? Does docker rely on chroot? I ask this because "Docker is not virtualisation: ...
-5
votes
1answer
67 views

What is “a light-weight namespace container” created by systemd-spawn?

man systemd-nspawn says systemd-nspawn may be used to run a command or OS in a light-weight namespace container. In many ways it is similar to chroot(1), but more powerful since it fully ...
2
votes
0answers
21 views

Create a route to an existing namespace

I have a namespace with an existing interface in it: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:...
-1
votes
1answer
19 views

reusing same port in a tcp application under different namespaces on linux VM

i have a linux VM with 2 interfaces, eth0 has mgmt IP and eth1 has configuration as below ip netns exec eng51 ifconfig eth1.51 Link encap:Ethernet HWaddr 52:54:00:bd:68:c3 inet addr:51.51....
0
votes
0answers
70 views

Why does `systemd-nspawn -n` network namespace not show in `ip netns list`

tl;dr Linux has namespaces, in particular, network namespaces. It seems the namespace supposedly created via the -n flag when running systemd-nspwawn does not show up when employing ip netns list (...
0
votes
1answer
26 views

How to lock some resource in a shared network namespace

I would like to implement the functionality similar to pid file but for network namespace. In common file namespace the process can lock pid file and ensure that no other process is running in the ...
0
votes
0answers
14 views

Can /sys be sanitized for use with linux namespaces (i.e. via systemd-nspawn)?

The tool systemd-nspawn is descriped as allowing this: systemd-nspawn - Spawn a command or OS in a light-weight container systemd-nspawn may be used to run a command or OS in a light-weight ...
4
votes
1answer
76 views

How do I find all interfaces that have been configured in Linux, including those of containers?

I know that you can display interfaces by doing ip a show. That only displays the interfaces that the host can see, but virtual interfaces configured by containers don't appear in this list. I've ...
0
votes
1answer
37 views

What other `namespace` oriented linux commands are there?

By other I mean to say that I ran into the command: nsenter and have been thinking that there might be other tools/commands geared to working with and debugging namespaces. Are there? Keep in mind I'...
0
votes
0answers
35 views

Difference between SUID and user namespace

I was reading up on rootless containers which have the possibility to have unprivileged non-root containers where the parent process or tool that starts the application container itself runs as "non-...
0
votes
0answers
28 views

Using Cgroup inside network namespace?

I have a dedicated machine with multiple host interfaces [eth0 for host network] and (eth1, eth2, eth3) additional, 3-static available IPs. I want to create 3 network namespaces for each of these ...
4
votes
1answer
56 views

Is there a file that associates a thread to its network namespace?

/proc/[pid]/ns/net contains a link to the inode representing the network namespace of the process with PID [pid]. Is there something similar for threads? My use case is a multi-threaded application, ...
1
vote
0answers
28 views

Access usb wireless adapter from network namespace

I have a wireless usb adapter and I would like my docker container to use just this for the internet (not the computers own wireless adapter). I think I can do this if I know how to access the adapter ...
0
votes
1answer
122 views

Route from netns through a veth link

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is ...
0
votes
0answers
120 views

Filesystem permission problems with user namespaces and debootstrap

I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better). I am currently running the following commands to start an ...
1
vote
1answer
129 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
1
vote
1answer
193 views

With Linux user namespaces, why can clone() mount /proc, but unshare() cannot?

I am trying to get a non-root user to mount /proc in a Linux user namespace. If I create a namespace via clone(), then I can mount /proc. However, if I create a namespace via unshare(), then the ...
1
vote
1answer
768 views

Unable to create user namespace in RHEL

I'm trying to create user namespace in RHEL 7 but unable to because of the below error: [root@teja7131 ~]# unshare -U /bin/bash unshare: unshare failed: Invalid argument Please explain the correct ...
2
votes
1answer
926 views

How do you debug inability to delete a Namespace after ip netns add test [closed]

cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct) cgroup on /sys/fs/...
3
votes
1answer
260 views

firejail : only let a program access localhost

I have this local network service and this client program needing to access it. I am running them both as an unprivileged user. I am looking for a way to sandbox the client using firejail, in a way ...
1
vote
2answers
210 views

Is it possible for mount(8) to override systemd MountFlags?

I am working on Debian stretch/4.14.75 and have been using my own automounter (udev-hook + shell-script) for years. Since it breaks recently due to the namespace problem that the mounted directory is ...
2
votes
1answer
80 views

What code prevents mount namespace loops? In a more complex case involving mount propagation

Background information The following commands return an error: # touch /tmp/a # mount --bind /proc/self/ns/mnt /tmp/a mount: /tmp/a: wrong fs type, bad option, bad superblock on /proc/self/ns/mnt, ...
2
votes
1answer
142 views

What happens to the mount namespace of an interrupted process

I am experimenting with mount namespaces. I have a python script, which creates a bind mount, after that a mount namespace with the unshare system call. I print the PID, and pause the script. I can ...
0
votes
1answer
118 views

How to Keep Network Namespace after reboot

I have created a network namespace, but after I have reboot, it've been removed. I don't found an answer at this problem on the internet, so this is why I'm asking you : Is there a way to keep a ...
0
votes
1answer
441 views

Namespace management with ip netns (iproute2)

I would like to know where to look up changes applied to custom namespaces. Let's say I have a namespace "ns1" with virtual interfaces "vpeer" and "lo" inside and I would like to modify configurations ...
1
vote
1answer
91 views

Is devtmpfs special with respect to namespaces? a permissions problem

I'm wondering if devtmpfs is special with respect to namespaces. Here's my system info (using Vagrant for testing) vagrant@ubuntu-xenial:~/test$ uname -a Linux ubuntu-xenial 4.4.0-135-generic #161-...
2
votes
1answer
1k views

What is the NSFS filesystem?

The kernel contains a filesystem, nsfs. snapd creates a nsfs mount under /run/snapd/ns/<snapname>.mnt for each installed snap. ls shows it as a 0 byte file. The kernel source code does not seem ...
1
vote
0answers
60 views

Keeping a PID from being reused by mounting /proc/[pid]/ns/pid?

I'm looking for a way to temporarily prevent a process ID from being reused. The man page for NAMESPACES(7) says: Bind mounting (see mount(2)) one of the files in [/proc/[pid]/ns/] to somewhere ...
2
votes
1answer
170 views

Inside a user namespace, why am I not allowed to remount a filesystem I have mounted?

https://github.com/systemd/systemd/issues/9914#issuecomment-416387637 $ uname -r 4.17.18-200.fc28.x86_64 $ unshare -U -r -m # mkdir TMP # mount -t tmpfs tmpfs TMP/ # mount -o remount,ro TMP/ mount: ....
1
vote
1answer
795 views

Understanding how mount namespaces work in Linux

I am reading about mount namespaces and see: in a mount namespace you can mount and unmount filesystems without it affecting the host filesystem. So you can have a totally different set of devices ...
0
votes
1answer
34 views

Could the mount namespace API effectively be made redundant? What obstacles would there be?

You can still access files and directories in a different mount namespace, if you have a reference to them. However, currently you can't manipulate (or even list) the mounts of a mount namespace, if ...
0
votes
1answer
127 views

How to `unshare -n` without changing to root?

I'd like to run a shell that behaves exactly like the parent but without network. Why do I have to su <login> after unshare?