Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Running multiple isolated NFS Servers

I have a computer on my network which I want to run multiple NFS servers on. Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export ...
0
votes
1answer
14 views

Connect SSH in UTS namespace (host-name namespace) in Ubuntu VM from host Windows

I've an assignment for school to research about namespaces. For all of them I've made examples but UTS is not simple to demonstrate. I've read UTS namespace is often used in vservers for admin ...
0
votes
1answer
84 views

Extra mount points for systemd service

I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat ...
0
votes
1answer
40 views

Unable to ping external network from namespace, probably postrouting not working

I'm trying to ping an external ip (in this case google) from inside a network namespace. ip netns add ns1 # Create v-eth1 and v-peer1: v-eth1 is in the host space whereas peer-1 is supposed to be ...
0
votes
0answers
43 views

Is there a way to give a user access to a file without adding it to sudoers?

My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter. The usual ...
4
votes
0answers
66 views

When does Linux “garbage-collect” namespaces?

My current understanding of Linux (kernel) namespaces is that their lifetime after creation is as long as at least one of the following conditions holds true: at least one process/thread is joined (...
4
votes
0answers
186 views

How can I make a device available inside a systemd-nspawn container with user namespacing?

I would like to mount an encrypted image file using cryptsetup inside a systemd-nspawn container. However, I get this error message: [root@container ~]# echo $key | cryptsetup -d - open luks.img luks ...
0
votes
1answer
53 views

What is the old_root concept in pivot_root?

From man 2 pivot_root pivot_root() moves the root file system of the current process to the directory _put_old_ and makes _new_root_ the new root file system of the current process. int ...
1
vote
1answer
141 views

systemd “Failed to set up mount namespacing” in Docker container

I recently updated a Docker that uses systemd internally from Debian stretch to Debian buster. And since then it's not working. So accoding to systemctl status it fails to setup the namespace: Dec ...
0
votes
0answers
41 views

What is the use of pivot root in mount namespace?

I am trying to understand use of pivot_root in a mount namespace. The documentation regarding pivot_root is complex. Can anyone kindly explain the use of pivot_root with real-world use-cases?
2
votes
2answers
96 views

How to find total active namespaces in linux?

Is there any way to find how many active namespaces of each type are present in Linux? Such as: mount ns: 20 net ns: 40 etc.
0
votes
1answer
26 views

Estimate number of LOC of namespaces implementation and bpf implementation

How can I estimate the LOC of a linux component? In this case I would compare the LOC number that implement namespaces with the number of LOC which implement BPF.
1
vote
2answers
102 views

Sourced Bash script, each with main function

I am using Bash 4.4.20. I typically have main function in each bashscript. If I want to source this script from another function inside another bash script, will this conflict with the main function ...
0
votes
0answers
46 views

ip netns list-id show nsid number keep increase

We built a system with two containers. Both containers have network configuration, the config file of the container will be list below. Issue: When two containers startup, use ip netns list-id, it ...
1
vote
0answers
18 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
0
votes
0answers
29 views

Why does user_namespace isolate the root directory?

User namespaces isolate [...] the root directory [...]. http://man7.org/linux/man-pages/man7/user_namespaces.7.html I thought root is more of a concept like we build houses on the floor. So if I ...
2
votes
0answers
21 views

Is there a standard namespace for local definitions of multi-key characters in the ~/.XCompose file?

I want to add some personal definitions to my ~/.XCompose file, but I don't want them to conflict with any official definitions (especially those that appear in the future and aren't defined yet). Is ...
3
votes
0answers
79 views

I can ping across namespaces, but not connect with TCP

I'm trying to set up two network namespaces to communicate with eachother. I've set up two namespaces, ns0 and ns1 that each have a veth pair, where the non-namespaced side of the veth is linked to a ...
1
vote
2answers
64 views

What parts of the kernel are not namespace aware? [closed]

I've started to learn Docker security, and so have come across cgroups, namespaces, and capabilities, which together with chroot form the basis of modern container technologies. Historically many ...
1
vote
0answers
84 views

fuse allow_root is not set - why files in user mount is seen via sudo?

Why root can see user files when allow_root is not set by fuse? (user2 get permission denied for ls /media/user1/Data, but can see files via sudo, Linux Mint 19). user2@PC:~$ cat /etc/fuse.conf ... # ...
0
votes
0answers
74 views

How do I route access point traffic through a network namespace using nftables?

First I create a "vpn" network namespace and a veth pair to connect it to the internet via my "ens32" wired ethernet adapter. Then I start openvpn inside the network namespace. Everything in the "vpn" ...
2
votes
1answer
85 views

How to find official documentation about Linux kernel namespaces?

I've been using Docker for a while and I'm interested in learning its internals. I've read about kernel namespaces it uses. But I don't understand how they are used. So my problem is: I haven't found ...
1
vote
0answers
325 views

Docker mapped port doesn't show up on “netstat”, “ss” and “lsof”

I've a question about docker containers and sockets. Today i've discovered that, docker containers with mapped port -p 80:80 (or etc ports) on the host system, doesn't show up when i use netstat, ss ...
3
votes
1answer
142 views

InterVLAN between namespaces using a third namespace as a router [closed]

I need to establish connection between 2 namespaces (one has ip add 10.0.0.1/24 gateway 10.0.0.254 and the other one has ip add 20.0.0.1/24 gateway 20.0.0.254), separated in different VLANs (10 and 20)...
1
vote
1answer
42 views

How are user namespace mappings resolved between namespaces?

Let's say I spawn 2 processes in 2 different namespaces as described by this LWN article. The first one maps UID 0 inside the ns to UID 1000 outside the ns. The second one maps UID 200 inside the ns ...
1
vote
2answers
112 views

Relation between processes and user namespaces

I'm studying containerization mechanisms. The man page for user namespaces states: "Each process is a member of exactly one user namespace." I'm also trying to follow this article where the author ...
1
vote
0answers
163 views

Could not display /location “the location is not a folder” error - mount of other user displayed in Nemo file manager

I added another say user2 on Linux Mint system (19.2), logged-on and started X, then Nemo file manager. On the left on Devices expandable list I see links e.g. /media/user1/data (/dev/sda5), when I ...
3
votes
1answer
99 views

How to make /dev inside linux namespaces

AFAIK the container terminology, what I'm essentially trying to accomplish is to write my own "container runtime". What I'm doing: user@host:~$ mkdir test user@host:~$ cd test user@host:~/test$ ...
0
votes
1answer
150 views

Why unshare -p does not imply -f and --mount-proc?

The man page specifies that you may be interested in using --fork and --mount-proc when creating a PID namespace, but why those options are not default?
2
votes
2answers
105 views

What sort of file thing do 'namespace files' point to?

I was poking around /proc/*/ns, and noticed that namespace files look unfamiliar: # example from `man namespaces` $ ls -l /proc/$$/ns total 0 lrwxrwxrwx. 1 mtk mtk 0 Apr 28 12:46 cgroup -> cgroup:[...
1
vote
1answer
171 views

Run ssh daemon in different namespace to connected clients

If sshd is running in the (non-init) namespace of the appropriate physical device: ip netns exec physical sshd is it possible to have clients that connect on that interface get a shell with the ...
3
votes
0answers
140 views

How to mount files as specific user when using docker namespace remapping?

Problem description: I have a webservice using docker to run nginx and haproxy (among other containers). I want to provide these docker images via a private docker hub registry, and thus don't want ...
6
votes
0answers
403 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
1
vote
0answers
74 views

mount proc filestsrem inside namespace

I had a rootfs of a linux os (like ubuntu or centos) and removed mount command inside that . now, is there any way to mount proc filesystem with nsenter or unshare or any other command inside a ...
0
votes
0answers
112 views

User namespace error - /dev/pts mode change

I am doing a simple test on user namespace on Ubuntu 16.04 as shown below. root@PC:/# root@PC:/# unshare --user --map-root-user mesg: change /dev/pts/2 mode failed: Operation not permitted root@PC:/#...
0
votes
0answers
256 views

execve(2) not launching system commands

I am trying to implement a container, and for that I create a process using the clone(2) system call with the appropriate flags: if ((child_pid = clone(child_main, process_struct.Stack + ...
1
vote
1answer
74 views

error creating namespaces

I am trying to create a process with new namespaces, and for that i need to use clone(2) with the appropriate flags, the following is the clone system call and a printf() statement to print the parent ...
1
vote
1answer
109 views

Sound is not detected in a namespace

I created a namespace and ran a terminal like that: ip netns exec <namespace> gnome-terminal As by default namespace are handled in root, when I open the terminal I change to my normal user: ...
3
votes
1answer
134 views

About mounting and umounting inherited mounts inside a newly-created mount namespace

Experiment 1 From outside the namespace, cat /proc/self/mountinfo gives 291 34 0:37 / /tmp/IMJUSTTMP rw,relatime shared:152 - tmpfs tmpfs rw,size=102400k 34 23 0:32 / /tmp rw,nosuid,nodev shared:16 -...
3
votes
1answer
154 views

Why can I not bind a mount namespace to a file

I observe the following: As unprivileged user in shell No 1: user@box:~$ sysctl kernel.unprivileged_userns_clone kernel.unprivileged_userns_clone = 1 user@box:~$ unshare --mount --user nobody@box:~$ ...
1
vote
0answers
46 views

Running su inside mount namespace

I am testing mount namespace using the following steps: # unshare --mount # mount --bind rootfs/ ns_dir/ # cd ns_dir/ # pivot_root . . # cd / My rootfs has sub-folders /lib, /bin, /etc. I have put ...
0
votes
1answer
55 views

pivot_root(2) causes system crash

I am trying to change the root of my process to new file system that I mounted at /tmp/mount_dir and i have created another directory inside it /tmp/mount_dir/inner_mount_dir, and according to the man ...
0
votes
0answers
112 views

Can two threads in the same process belong to different namespaces?

The task_struct structure has an entry nsproxy which points to namespaces associated with the task_struct. My understanding is that task_struct can be used to represent both process and threads in ...
1
vote
1answer
100 views

Namespace numbers in /proc

I am checking the namespaces associated with a shell process as follows: # ll /proc/$$/ns total 0 dr-x--x--x 2 root root 0 May 2 15:10 ./ dr-xr-xr-x 9 root root 0 May 1 18:39 ../ lrwxrwxrwx 1 root ...
1
vote
1answer
201 views

Invalid arguments when mounting with MS_SHARED

I am trying to mount the ext4 file system on /mnt into mount_dir which is a temporary directory I created using mkdtemp(2) with MS_SHARED then a remount with MS_PRIVATE, The idea is creating a mount ...
2
votes
0answers
238 views

Restrictions on pivot_root to switch root filesystem

This question is a follow up to the question I asked on how LXC setups up its root mount point. For a container named testcontainer, LXC uses bind mount to mount /var/lib/lxc/testcontainer/rootfs to /...
0
votes
1answer
116 views

Why are Linux namespace links in /proc red in color?

I inspected the symlinks in an Ubuntu VM for the namespace related directories under /proc/PID/ns. I see all the links are in red color. I even tried to test using unshare to see if I can create a ...
2
votes
1answer
277 views

How does LXC setup its root mount point?

I am trying to experiment with mount namespace in Ubuntu. So far I can create an empty mount namespace using the following: # mkdir test # unshare --mount # mount none test -t tmpfs # cd test # ...
0
votes
1answer
96 views

Why does unshare binary call clone() so many times?

I am trying to test the unshare command in Linux. I am using it to create a new user namespace. I tried the following test: user1@myPC$ strace -e clone,unshare,fork,execve unshare --user execve("/usr/...
3
votes
0answers
64 views

Is linux mount propagation asynchronous to the mount call?

I have two processes in different mount namespaces. They have a shared directory bind mounted to /mnt/share. The "master" uses MS_SHARED propagation for the mount, while the "slave" uses MS_SLAVE. ...