Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
1
vote
0answers
11 views

Error: Connection activation failed: Failed to find a compatible device for this connection

Hi linux newbie here pardon any mistakes. I have configured a network namespace local-routeTable and have brought up interface eth3 inside the namespace: # ip netns exec local-routeTable ifconfig eth3:...
1
vote
1answer
22 views

ping inside netns requires sudo (Fedora)

Using fedora 32, I launched a shell inside a network namespace using sudo ip netns add net0 sudo ip netns exec net0 sudo -u fred /usr/bin/bash I configured the network links and firewall to enable ...
1
vote
0answers
26 views

how to create FTP server in namespace

Lets say i created two namespace in Ubuntu. ip netns add A ip netns add B now create Macvlan corresponding to each namespaces ip link add macvlanA link wlo1 type macvlan mode bridge ip link set ...
0
votes
0answers
10 views

How to make a namespace visible inside a chrooted/NEWPID process

I create a new process using CLONE_NEWPID and chroot to /mnt/ Outside of that, I create a new netns using the ip netns command. e.g. ip netns add test1 Any idea how can I make the chrooted process, ...
3
votes
1answer
55 views

How can a process hold a capability in another namespace?

I'm brooding over the interactions between namespaces and capabilities. Occasionally, I stumble over wording like the following from user_namespaces(7): Holding CAP_SYS_ADMIN within the user ...
0
votes
1answer
59 views

How can I enable user namespaces and have it persist after reboot?

When I run podman I get, $ podman info cannot clone: Operation not permitted user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone Error: cannot re-exec process How can I ...
0
votes
0answers
24 views

Why do my Send-Q keep getting loaded but nothing come out of it?

I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
0
votes
0answers
11 views

How can multiple cgroup namespaces be merged?

I stumbled upon an interesting cgroup setup and I want to understand how it works. It appeared like two separate Docker containers' cgroups were "merged" into a third cgroup which was a ...
1
vote
0answers
27 views

How to update UID/GID in /etc/passwd and /etc/group when using --private-users=pick with systemd containers

sorry for the stupid question as am noob. I have OpenSuseLeap container on my manjaro Linux, I used to login into it and everything was working. I was happy with the command:- sudo systemd-nspawn -b -...
0
votes
1answer
48 views

Network namespace as a regular user

In linux you can create network namespaces, using the ip command. But you need to be root to run that command. However you can still create network namespaces as a regular user using unshare -rUn. ...
1
vote
1answer
54 views

Can I move mount to other mount namespace

Question : Is there any way I could move/copy mount from one namespace to another? Explanation: I would like to mount directory which didn't exist when container was created. I am creating container. ...
0
votes
0answers
58 views

Create network namespace with full network access [LINUX]

I created a linux namespace using this script : read -p "ip : " ip ip netns add myvpn ip netns exec myvpn ip addr add 127.0.0.1/8 dev lo ip netns exec myvpn ip link set lo up ip link add ...
-1
votes
1answer
80 views

Do user (group) ID mappings in `/proc/[pid]/uid_map` (`/proc/[pid]/gid_map`) only apply for the process `[pid]` or globally for the whole namespace?

After reading man user_namespaces, I'm not sure, whether user (group) ID mappings to the parent namespace, set in /proc/[pid]/uid_map (/proc/[pid]/gid_map), apply to all processes in the namespace or ...
4
votes
1answer
244 views

Why does `nsenter` need to call `fork` before `exec` to ensure that any children will also be in the newly entered PID namespace?

I assume that nsenter, which runs as a sub-process of bash, utilizes the setns system call to join an existing namespace and then executes the specified program using exec. But, if nsenter has ...
3
votes
1answer
111 views

Can subordinate user ID be used to grant file system permissions?

Suppose I have user "myuser" with uid/gid "1001", and files "/etc/subuid" & "/etc/subgid" with the following content: myuser:100000:65536 Can this setup somehow be used to allow user "myuser" to ...
2
votes
2answers
103 views

Environment variables when running unshare

Is there any namespace (process, user, etc) that isolates environment variables? In case there is, what happens when you unshare? Do they get cloned? What happens if a process changes an existing ...
5
votes
0answers
211 views

Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?

I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug? When some process opens /proc/<pid>/net/dev it can ...
1
vote
0answers
39 views

How to use host PTY in container?

I'm learning about container technologies of Linux and wrote a minimal container implementation on my own. I'm currently confused about consoles / terminals for container processes, as I'm "reusing" ...
2
votes
2answers
92 views

Strange behaviour of pivot_root(“.”, “.”) in mount namespace

I'm trying to understand containers and stumbled upon a trick apparently found by the LXC developers, see this runc PR: You can call pivot_root(".", ".") which avoids the need for a directory to put ...
1
vote
1answer
114 views

How to check the device number of a device in `/proc/1/ns/{ns}`?

How to check the device number of a device in /proc/1/ns/{ns}? I've read the code for a Go library (see below), which states that it's possible to determine, if a container is in the host namespace ...
0
votes
0answers
88 views

Running multiple isolated NFS Servers

I have a computer on my network which I want to run multiple NFS servers on. Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export ...
0
votes
1answer
84 views

Connect SSH in UTS namespace (host-name namespace) in Ubuntu VM from host Windows

I've an assignment for school to research about namespaces. For all of them I've made examples but UTS is not simple to demonstrate. I've read UTS namespace is often used in vservers for admin ...
0
votes
1answer
268 views

Extra mount points for systemd service

I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat ...
0
votes
1answer
149 views

Unable to ping external network from namespace, probably postrouting not working

I'm trying to ping an external ip (in this case google) from inside a network namespace. ip netns add ns1 # Create v-eth1 and v-peer1: v-eth1 is in the host space whereas peer-1 is supposed to be ...
0
votes
0answers
47 views

Is there a way to give a user access to a file without adding it to sudoers?

My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter. The usual ...
4
votes
0answers
110 views

When does Linux “garbage-collect” namespaces?

My current understanding of Linux (kernel) namespaces is that their lifetime after creation is as long as at least one of the following conditions holds true: at least one process/thread is joined (...
12
votes
1answer
579 views

How can I make a device available inside a systemd-nspawn container with user namespacing?

I would like to mount an encrypted image file using cryptsetup inside a systemd-nspawn container. However, I get this error message: [root@container ~]# echo $key | cryptsetup -d - open luks.img luks ...
0
votes
1answer
121 views

What is the old_root concept in pivot_root?

From man 2 pivot_root pivot_root() moves the root file system of the current process to the directory _put_old_ and makes _new_root_ the new root file system of the current process. int ...
1
vote
1answer
468 views

systemd “Failed to set up mount namespacing” in Docker container

I recently updated a Docker that uses systemd internally from Debian stretch to Debian buster. And since then it's not working. So accoding to systemctl status it fails to setup the namespace: Dec ...
2
votes
2answers
153 views

How to find total active namespaces in linux?

Is there any way to find how many active namespaces of each type are present in Linux? Such as: mount ns: 20 net ns: 40 etc.
0
votes
1answer
27 views

Estimate number of LOC of namespaces implementation and bpf implementation

How can I estimate the LOC of a linux component? In this case I would compare the LOC number that implement namespaces with the number of LOC which implement BPF.
1
vote
2answers
1k views

Sourced Bash script, each with main function

I am using Bash 4.4.20. I typically have main function in each bashscript. If I want to source this script from another function inside another bash script, will this conflict with the main function ...
0
votes
0answers
115 views

ip netns list-id show nsid number keep increase

We built a system with two containers. Both containers have network configuration, the config file of the container will be list below. Issue: When two containers startup, use ip netns list-id, it ...
1
vote
0answers
19 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
0
votes
0answers
36 views

Why does user_namespace isolate the root directory?

User namespaces isolate [...] the root directory [...]. http://man7.org/linux/man-pages/man7/user_namespaces.7.html I thought root is more of a concept like we build houses on the floor. So if I ...
2
votes
0answers
28 views

Is there a standard namespace for local definitions of multi-key characters in the ~/.XCompose file?

I want to add some personal definitions to my ~/.XCompose file, but I don't want them to conflict with any official definitions (especially those that appear in the future and aren't defined yet). Is ...
3
votes
0answers
255 views

I can ping across namespaces, but not connect with TCP

I'm trying to set up two network namespaces to communicate with eachother. I've set up two namespaces, ns0 and ns1 that each have a veth pair, where the non-namespaced side of the veth is linked to a ...
1
vote
2answers
104 views

What parts of the kernel are not namespace aware? [closed]

I've started to learn Docker security, and so have come across cgroups, namespaces, and capabilities, which together with chroot form the basis of modern container technologies. Historically many ...
1
vote
0answers
280 views

fuse allow_root is not set - why files in user mount is seen via sudo?

Why root can see user files when allow_root is not set by fuse? (user2 get permission denied for ls /media/user1/Data, but can see files via sudo, Linux Mint 19). user2@PC:~$ cat /etc/fuse.conf ... # ...
2
votes
1answer
126 views

How to find official documentation about Linux kernel namespaces?

I've been using Docker for a while and I'm interested in learning its internals. I've read about kernel namespaces it uses. But I don't understand how they are used. So my problem is: I haven't found ...
2
votes
0answers
857 views

Docker mapped port doesn't show up on “netstat”, “ss” and “lsof”

I've a question about docker containers and sockets. Today i've discovered that, docker containers with mapped port -p 80:80 (or etc ports) on the host system, doesn't show up when i use netstat, ss ...
3
votes
1answer
255 views

InterVLAN between namespaces using a third namespace as a router [closed]

I need to establish connection between 2 namespaces (one has ip add 10.0.0.1/24 gateway 10.0.0.254 and the other one has ip add 20.0.0.1/24 gateway 20.0.0.254), separated in different VLANs (10 and 20)...
1
vote
1answer
57 views

How are user namespace mappings resolved between namespaces?

Let's say I spawn 2 processes in 2 different namespaces as described by this LWN article. The first one maps UID 0 inside the ns to UID 1000 outside the ns. The second one maps UID 200 inside the ns ...
1
vote
2answers
356 views

Relation between processes and user namespaces

I'm studying containerization mechanisms. The man page for user namespaces states: "Each process is a member of exactly one user namespace." I'm also trying to follow this article where the author ...
1
vote
0answers
417 views

Could not display /location “the location is not a folder” error - mount of other user displayed in Nemo file manager

I added another say user2 on Linux Mint system (19.2), logged-on and started X, then Nemo file manager. On the left on Devices expandable list I see links e.g. /media/user1/data (/dev/sda5), when I ...
3
votes
1answer
183 views

How to make /dev inside linux namespaces

AFAIK the container terminology, what I'm essentially trying to accomplish is to write my own "container runtime". What I'm doing: user@host:~$ mkdir test user@host:~$ cd test user@host:~/test$ ...
0
votes
1answer
361 views

Why unshare -p does not imply -f and --mount-proc?

The man page specifies that you may be interested in using --fork and --mount-proc when creating a PID namespace, but why those options are not default?
2
votes
2answers
208 views

What sort of file thing do 'namespace files' point to?

I was poking around /proc/*/ns, and noticed that namespace files look unfamiliar: # example from `man namespaces` $ ls -l /proc/$$/ns total 0 lrwxrwxrwx. 1 mtk mtk 0 Apr 28 12:46 cgroup -> cgroup:[...
2
votes
1answer
384 views

Run ssh daemon in different namespace to connected clients

If sshd is running in the (non-init) namespace of the appropriate physical device: ip netns exec physical sshd is it possible to have clients that connect on that interface get a shell with the ...
3
votes
0answers
212 views

How to mount files as specific user when using docker namespace remapping?

Problem description: I have a webservice using docker to run nginx and haproxy (among other containers). I want to provide these docker images via a private docker hub registry, and thus don't want ...