Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

2
votes
0answers
17 views

Create a route to an existing namespace

I have a namespace with an existing interface in it: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:...
-1
votes
1answer
11 views

reusing same port in a tcp application under different namespaces on linux VM

i have a linux VM with 2 interfaces, eth0 has mgmt IP and eth1 has configuration as below ip netns exec eng51 ifconfig eth1.51 Link encap:Ethernet HWaddr 52:54:00:bd:68:c3 inet addr:51.51....
0
votes
0answers
17 views

Why does `systemd-nspawn -n` network namespace not show in `ip netns list`

tl;dr Linux has namespaces, in particular, network namespaces. It seems the namespace supposedly created via the -n flag when running systemd-nspwawn does not show up when employing ip netns list (...
0
votes
1answer
23 views

How to lock some resource in a shared network namespace

I would like to implement the functionality similar to pid file but for network namespace. In common file namespace the process can lock pid file and ensure that no other process is running in the ...
0
votes
0answers
11 views

Can /sys be sanitized for use with linux namespaces (i.e. via systemd-nspawn)?

The tool systemd-nspawn is descriped as allowing this: systemd-nspawn - Spawn a command or OS in a light-weight container systemd-nspawn may be used to run a command or OS in a light-weight ...
4
votes
1answer
52 views

How do I find all interfaces that have been configured in Linux, including those of containers?

I know that you can display interfaces by doing ip a show. That only displays the interfaces that the host can see, but virtual interfaces configured by containers don't appear in this list. I've ...
0
votes
1answer
35 views

What other `namespace` oriented linux commands are there?

By other I mean to say that I ran into the command: nsenter and have been thinking that there might be other tools/commands geared to working with and debugging namespaces. Are there? Keep in mind I'...
0
votes
0answers
19 views

Difference between SUID and user namespace

I was reading up on rootless containers which have the possibility to have unprivileged non-root containers where the parent process or tool that starts the application container itself runs as "non-...
0
votes
0answers
22 views

Using Cgroup inside network namespace?

I have a dedicated machine with multiple host interfaces [eth0 for host network] and (eth1, eth2, eth3) additional, 3-static available IPs. I want to create 3 network namespaces for each of these ...
4
votes
1answer
41 views

Is there a file that associates a thread to its network namespace?

/proc/[pid]/ns/net contains a link to the inode representing the network namespace of the process with PID [pid]. Is there something similar for threads? My use case is a multi-threaded application, ...
1
vote
0answers
19 views

Access usb wireless adapter from network namespace

I have a wireless usb adapter and I would like my docker container to use just this for the internet (not the computers own wireless adapter). I think I can do this if I know how to access the adapter ...
0
votes
1answer
65 views

Route from netns through a veth link

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is ...
0
votes
0answers
68 views

Filesystem permission problems with user namespaces and debootstrap

I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better). I am currently running the following commands to start an ...
1
vote
0answers
59 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
1
vote
1answer
136 views

With Linux user namespaces, why can clone() mount /proc, but unshare() cannot?

I am trying to get a non-root user to mount /proc in a Linux user namespace. If I create a namespace via clone(), then I can mount /proc. However, if I create a namespace via unshare(), then the ...
1
vote
1answer
409 views

Unable to create user namespace in RHEL

I'm trying to create user namespace in RHEL 7 but unable to because of the below error: [root@teja7131 ~]# unshare -U /bin/bash unshare: unshare failed: Invalid argument Please explain the correct ...
2
votes
1answer
690 views

How do you debug inability to delete a Namespace after ip netns add test [closed]

cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct) cgroup on /sys/fs/...
3
votes
1answer
193 views

firejail : only let a program access localhost

I have this local network service and this client program needing to access it. I am running them both as an unprivileged user. I am looking for a way to sandbox the client using firejail, in a way ...
1
vote
2answers
127 views

Is it possible for mount(8) to override systemd MountFlags?

I am working on Debian stretch/4.14.75 and have been using my own automounter (udev-hook + shell-script) for years. Since it breaks recently due to the namespace problem that the mounted directory is ...
2
votes
1answer
61 views

What code prevents mount namespace loops? In a more complex case involving mount propagation

Background information The following commands return an error: # touch /tmp/a # mount --bind /proc/self/ns/mnt /tmp/a mount: /tmp/a: wrong fs type, bad option, bad superblock on /proc/self/ns/mnt, ...
2
votes
1answer
100 views

What happens to the mount namespace of an interrupted process

I am experimenting with mount namespaces. I have a python script, which creates a bind mount, after that a mount namespace with the unshare system call. I print the PID, and pause the script. I can ...
0
votes
1answer
74 views

How to Keep Network Namespace after reboot

I have created a network namespace, but after I have reboot, it've been removed. I don't found an answer at this problem on the internet, so this is why I'm asking you : Is there a way to keep a ...
0
votes
1answer
336 views

Namespace management with ip netns (iproute2)

I would like to know where to look up changes applied to custom namespaces. Let's say I have a namespace "ns1" with virtual interfaces "vpeer" and "lo" inside and I would like to modify configurations ...
1
vote
1answer
74 views

Is devtmpfs special with respect to namespaces? a permissions problem

I'm wondering if devtmpfs is special with respect to namespaces. Here's my system info (using Vagrant for testing) vagrant@ubuntu-xenial:~/test$ uname -a Linux ubuntu-xenial 4.4.0-135-generic #161-...
2
votes
1answer
833 views

What is the NSFS filesystem?

The kernel contains a filesystem, nsfs. snapd creates a nsfs mount under /run/snapd/ns/<snapname>.mnt for each installed snap. ls shows it as a 0 byte file. The kernel source code does not seem ...
1
vote
0answers
58 views

Keeping a PID from being reused by mounting /proc/[pid]/ns/pid?

I'm looking for a way to temporarily prevent a process ID from being reused. The man page for NAMESPACES(7) says: Bind mounting (see mount(2)) one of the files in [/proc/[pid]/ns/] to somewhere ...
2
votes
1answer
134 views

Inside a user namespace, why am I not allowed to remount a filesystem I have mounted?

https://github.com/systemd/systemd/issues/9914#issuecomment-416387637 $ uname -r 4.17.18-200.fc28.x86_64 $ unshare -U -r -m # mkdir TMP # mount -t tmpfs tmpfs TMP/ # mount -o remount,ro TMP/ mount: ....
1
vote
1answer
520 views

Understanding how mount namespaces work in Linux

I am reading about mount namespaces and see: in a mount namespace you can mount and unmount filesystems without it affecting the host filesystem. So you can have a totally different set of devices ...
0
votes
1answer
33 views

Could the mount namespace API effectively be made redundant? What obstacles would there be?

You can still access files and directories in a different mount namespace, if you have a reference to them. However, currently you can't manipulate (or even list) the mounts of a mount namespace, if ...
0
votes
1answer
95 views

How to `unshare -n` without changing to root?

I'd like to run a shell that behaves exactly like the parent but without network. Why do I have to su <login> after unshare?
7
votes
1answer
321 views

Losing permissions by adding capability?

I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups. In fact, writing to this file ...
12
votes
1answer
693 views

Why can't I bind-mount “/” inside a user namespace?

Why doesn't this work? $ unshare -rm mount --bind / /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /, missing codepage or helper program, or other error. These work ok: $ unshare -...
2
votes
1answer
430 views

Switching into a network namespace does not change /sys/class/net?

The Linux man page for network namespaces(7) says: Network namespaces provide isolation of the system resources associated with networking: [...], the /sys/class/net directory, [...]. However, ...
10
votes
1answer
830 views

How to perform chroot with Linux namespaces?

After reading about Linux namespaces I was under the impression that they are, amongst a lot of other features, an alternative to chroot. For example, in this article: Other uses [of namespaces] ...
1
vote
1answer
142 views

I don't understand how entering a mount namespace can work

either if you fork into a new mount namespace, or enter an existing one. It is possible to hold file descriptors from a foreign mount namespace. You can demonstrate this very easily, by finding a ...
1
vote
1answer
111 views

Linux mount namespace hopping considered harmful?

In an application, I need to temporarily "switch" into a specific mount namespace to check some things inside it in /proc, then switch back to the mount namespace my application was started with, then ...
0
votes
0answers
29 views

Linux processes without certain namespaces?

When chromium is running I see processes in /proc/[PID]/ where some of the namespace links inside /proc/[PID]/ns/do link to nothing, that is, they cannot be readlinked and return errors instead. Also ...
3
votes
1answer
507 views

Did the pivot_root() documentation anticipate the feature of mount namespaces?

pivot_root() moves the root filesystem of the calling process to the directory put_old and makes new_root the new root filesystem of the calling process. The typical use of pivot_root(...
5
votes
1answer
285 views

First process in a new Linux user namespace needs to call setuid()?

I'm learning about Linux user namespaces and I'm observing a strange behavior which isn't completely clear to me. I've created a range of UIDs in initial user namespaces to which I can map UIDs in ...
3
votes
2answers
657 views

Separate DNS configuration in each network namespace

I've set up several network namespaces on my Linux system (kernel version 3.10), and now I want to configure each network namespace to have its own DNS settings. I created resolv.conf files in each /...
1
vote
1answer
95 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the ...
1
vote
1answer
193 views

What rule prevents entering a user namespace from inside a chroot?

# rpm -q --whatprovides /usr/bin/unshare util-linux-2.32-2.fc28.x86_64 # unshare -r # i.e. the above succeeds, where the following does not. What rule causes this? # rpm -q --whatprovides /usr/sbin/...
2
votes
1answer
220 views

How to get pppd to create ppp0 inside namespace?

I have a simple pppoe connection which is working fine. A simple # pon my-isp creates a ppp0 device. I have defined a namespace like ip netns add physical but after ip netns exec physical pon my-...
5
votes
1answer
454 views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
0
votes
0answers
119 views

Modify existing overlay mount

Is it possible to insert additional lower layers to an existing overlayfs mount? The idea is to add new features to a running "chroot" so that they immediately see these changes in their root fs ...
1
vote
1answer
181 views

Configure delay and bandwidth in veth link

I have created 6 namespaces and have attached veth links between them. I'm trying to configure delay and bandwidth to the links, but the following error is shown : Cannot find device "eth0" Cannot ...
0
votes
1answer
631 views

Assign MAC address to a veth pair

I have created 6 namespaces and configured them with veth links. I'm trying to attach MAC address. But the following error is shown : SIOCSIFHWADDR: Cannot assign requested address SIOCSIFHWADDR: ...
0
votes
2answers
36 views

Distinguish the name and namespace

Reference to 'namespace', in Namespace - Wikipedia: In computing, a namespace is a set of symbols that are used to organize objects of various kinds, so that these objects may be referred to by ...
0
votes
0answers
178 views

Creating an exact copy of a whole process?

fork() forks a process, but it will not copy all of its threads; nor will it create a clone of all its fds: the fds are shared between parent and child. I want a way of do a complete fork. So after I ...
4
votes
1answer
505 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...