Skip to main content

Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

Mount in a directory I don't have permissions to for my user only

Is it possible to circumvent the traditional mount permission requirements if I just need my own user to see the mount? For example, I want to bind mount /home/$USER/folder into /folder. I do not have ...
Richard's user avatar
  • 41
0 votes
0 answers
23 views

How is the namespace able to communicate with eth0 without NAT here

I was following this tutorial https://github.com/faysalmehedi/linux-network-namespaces-hands-on I had to use this command so that our ns1 namespace can talk to eth0, where 192.168.1.1 is the IP ...
Arjun Hegde's user avatar
0 votes
1 answer
56 views

Why the access to /proc/[pid]/ns needs to generate symlinks?

The directories of the form /proc/[pid]/ns get populated each time they are accessed. That is, each time they are accessed the kernel produces a symlink to somewhere in the namespace filesystem (not ...
caciquekampeon's user avatar
3 votes
0 answers
65 views

Why can't root bypass permissions in an ID-mapped mount?

Why does global root (root in the initial user namespace) not have the ability to read all files regardless of permission when ID-mapped mounts (see "ID-mapped mounts" under man 2 ...
Joseph Sible-Reinstate Monica's user avatar
1 vote
1 answer
95 views

Connecting two network namespaces over a bridge

I'm trying to make one network namespace to be able to ping another namespace via a bridge. Here are the commands I'm executing: # create two namespaces ip netns add ns0 ip netns add ns1 # create a ...
AhmedWas's user avatar
  • 247
2 votes
0 answers
96 views

Mounting overlayfs in a user namespace with child mounts

I am trying to mount an overlayfs on /tmp from within a separate user & mount namespace. This works well unless /tmp already has a child mount in the original namespace, in which case this ...
Fabian Meumertzheim's user avatar
0 votes
0 answers
15 views

Virtual interface pair forwarding packets to each other

The goal is very simple: anything sent to pair1, as outgoing packet, should appear on pair0 as an incoming packet and vice versa. I am thinking on a layer3-only, virtual interface now. tun could do ...
peterh's user avatar
  • 9,828
3 votes
1 answer
138 views

Disable namespaces in Linux without compiling

Is there a way to disable all namespace types at boot time or runtime in Linux?
Melab's user avatar
  • 4,148
0 votes
0 answers
43 views

How to forward data via netns exec namespace

I'm using zmq to receive data from another pc. I would like to formard this received data to the Internet via namespace. I've created this python script: import subprocess import zmq context = zmq....
Raúl Parada Medina's user avatar
0 votes
0 answers
21 views

How to get full mountpoint path name by the sturct fc_context

In my kernel module, I've implemented a syscall hook named fsconfig to manage operations related to remounting readonly mountpoints. For instance, if a user executes mount /dev/sda /tmp/mytest -o ...
hongyun's user avatar
1 vote
1 answer
61 views

Can't use user/group IDs in unshared namespace

When mounting a tmpfs in a mount and user namespace that is separate from my 'regular' system, my expectation is that it's possible to use any user/group ID. There would be no need for mapping IDs ...
Banyoghurt's user avatar
2 votes
1 answer
57 views

Cannot close LUKS volume while any flatpak app is running

The problem I cannot cryptsetup close any LUKS volume while any flatpak app is running in the background. Yes, the flatpak app just has to be running in the background, I'm not trying to use ...
renzev's user avatar
  • 111
1 vote
0 answers
30 views

Isolating a child process in a remote desktop program

I'm developing a remote desktop/streaming program for linux. When a user logs in, they specify a program to launch, and the remote server launches that program as a new process. The server process ...
colinmarc's user avatar
  • 111
0 votes
1 answer
137 views

Kubernetes Namespace Stuck in 'Terminating'

I'm encountering an issue where a Kubernetes namespace is stuck in the 'Terminating' state. Running kubectl get ns cattle-monitoring-system -o json|jq produces error messages related to custom.metrics....
karlsebal's user avatar
  • 815
1 vote
0 answers
77 views

What is causing permission denied under proot?

At work I have limited access to my PC, so I am running proot with /nix mounted to give me access to nix package manager. However, executing some setuid commands fails under proot. $ proot /usr/bin/...
KamilCuk's user avatar
  • 870
0 votes
0 answers
112 views

How can I mount a 9p filesystem from an unprivileged user namespace?

I'm trying to mount a 9p filesystem from inside a user namespace. First, I run the 9p server: p9ufs -v --unix '/run/9p/srved' I then use the setuid binary 9mount (https://sqweek.net/code/9mount/) to ...
user589082's user avatar
1 vote
0 answers
228 views

What causes `newuidmap` to be dissallowed in new user namespace?

I expected uid=0(root) gid=0(root) groups=0(root) to be the output of both $ rootlesskit id $ unshare -U bash -c 'newuidmap $$ 0 '"$(id -u)"' 1; id' however the somewhat more verbose -x ...
humanityANDpeace's user avatar
0 votes
0 answers
95 views

systemd kill process and child with SIGTERM

Hi have a very strange scenario when my process (and its child) receives a SIGTERM and the sender is systemd (PID == 1). My setup is the following: two "simmetric" partitions mounted on /...
MirkoBanchi's user avatar
0 votes
1 answer
792 views

How to Make a Systemd Private Network Namespace Accessable

So I have an application that only binds to 0.0.0.0 and listens on a port (TCP). The communication is unencrypted and unauthorized so I'd like to work around that without getting too deep into the ...
WesAtWork's user avatar
  • 103
0 votes
1 answer
131 views

centos/linux: run tftpd in a non-default net namespace

I wonder if anyone succeeded starting a tftpd in a network namespace (I'm using tftp-server-5.2-22.el7.x86_64.rpm)? I.e., starting tftpd in a default NS is trivial: bash# systemctl start tftp bash# ...
Dmitry's user avatar
  • 73
0 votes
0 answers
98 views

How to control HOST systemd service inside pid namespace

Note: this is not about to run systemd inside namespace/container I need to control some service, from inside a namespace/container, but systemctl returns "Failed to connect to bus: No data ...
GongT's user avatar
  • 11
1 vote
1 answer
274 views

podman running as user dies after hard reboot - Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)

I'm struggling to determine what is going on here. Podman running in user space was running fine, but the server took a hard reboot and now it is... for lack of a more accurate technical assessment, ...
Grant Curell's user avatar
0 votes
1 answer
464 views

Cannot create an NVMe shared namespace and attach it to both primary and secondary controllers

I tried creating a namespace on a Samsung PM1735 NVMe SSD then attach it to primary (0x41) and secondary (0x1) controllers, but it's attaching only to the primary controller (I'm running on Ubuntu 20....
vcr's user avatar
  • 1
1 vote
0 answers
105 views

How to forward packets between net namespaces?

I have a lima VM with linux running Ubuntu 23.04 with kernel 6.2 and cgroupsv2. This VM is meant to serve as docker host. When I create docker network in this VM I get an interface in its own ...
Patryk's user avatar
  • 14.3k
2 votes
1 answer
893 views

Create new process namespace with existing mount namespace

I'm having trouble figuring out how to create a new process namespace once I exit from the one created by unshare. So, for example, I have the following. unshare -f --mount-proc --mount=/containers/1/...
Todd's user avatar
  • 141
2 votes
1 answer
387 views

Root network namespace as transit between 2 other net namespaces

I am trying to communicate between two network namespaces that are connected through the root namespaces using veth pairs as seen in the diagram. I am unable to perform a ping from netns A to netns B. ...
Rahul Raj Purohit's user avatar
1 vote
0 answers
194 views

How to firewall a network namespace using firewalld?

I'm running fedora 36 using firewalld as my firewall. I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this: ip ...
minamikoarikui's user avatar
3 votes
0 answers
289 views

Use Public IPv4 on Linux Network Namespace

I am using a VPS and gotten an extra IP address. I am trying and failing to assign the second IP address to a separate network namespace. Lets say my main IP and netmask is x.x.133.39/23 and my ...
alou S's user avatar
  • 31
0 votes
1 answer
478 views

systemd service timeout when using sudo

Target I am trying to run a service (transmission-daemon) in a network namespace for VPN usage. The service should automatically start using systemd. Implementation details I am using namespaced-...
HighDraw's user avatar
2 votes
1 answer
428 views

Unable to get a namespace to access the external network

I am running Linux in a VirtualBox environment. I have successfully defined 2 namespaces connected via a bridge that can talk to each other. I want to be able to get UDP packets out onto the actual ...
RD Florida's user avatar
1 vote
0 answers
336 views

Explanation of details in SOURCE column of findmnt

I have some questions regarding the output of the "findmnt" command, specifically the SOURCE column: TARGET SOURCE FSTYPE ...
Jared's user avatar
  • 11
0 votes
0 answers
193 views

Forward traffic from public IP to namespace

I have two VMs VM-A & VM-B connected via IPIP Tunnel in a namespace. I want the application in VM-B which is under namespace to be accessed from the public IP of VM-C. Can someone help me how can ...
ph3ro's user avatar
  • 378
4 votes
1 answer
1k views

What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?

While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
Dejan Zelic's user avatar
0 votes
1 answer
151 views

Fix Polyinstantiation of /tmp causing 'connect /tmp/.X11-unix/X0: No such file or directory'

In a multiseat desktop system with the /tmp directory polyinstantiated, the /tmp/.X11-unix/ directory and Xn instances are still created under root's /tmp not a user's. ssh -Ying into or out of the ...
SHawarden's user avatar
  • 554
1 vote
1 answer
1k views

Why is my namespace not detected?

I tried form home,then sudo su - ip netns exec 5bd337503b01 ip addr show Cannot open network namespace "5bd337503b01": No such file or directory pwd shows /var/run/docker/netns Why?
Richard Rublev's user avatar
0 votes
0 answers
36 views

Why is the default NameSpace of pid always 4026531836 [duplicate]

Why is the default NameSpace of pid always 4026531836. Whats special about this number?
Nagri's user avatar
  • 215
4 votes
1 answer
963 views

How do you get the child pid of `unshare` when using --fork for `nsenter -t <pid>`?

When using unshare --pid --fork, the nsenter command must attach to the child pid not the unshare pid to get to the right pid namespace. I can get unshare's pid as follows: unshare --pid --mount --...
KJ7LNW's user avatar
  • 495
2 votes
2 answers
746 views

Why is the Linux command `unshare --pid=p --mount=m` not creating a persistent namespace?

From everything I have read in the unshare and nsenter man pages, I should be able to bind-mount a directory to itself, mount --make-private the directory, and then use files within that directory to ...
KJ7LNW's user avatar
  • 495
1 vote
1 answer
253 views

If ports are unpriviledged, why can't I access them if I am root in a namespace?

I've run sudo sysctl -w net.ipv4.ip_unprivileged_port_start=1. However, sudo ip netns exec myvpn unshare -r python -m http.server -b 127.0.0.1 2 does not work. Strangely enough, this does: sudo ip ...
DrownedSuccess's user avatar
8 votes
1 answer
1k views

How does /proc interact with PID namespaces?

I do not understand how namespaces interact with /proc. I assumed that /proc returns values based on the process that queries them. For example, let's determine the PID of the current process inside ...
Georg Schölly's user avatar
0 votes
1 answer
462 views

How to login to a user namespace created by unshare?

How to login to a user namespace created by unshare -U from another terminal?
Franc's user avatar
  • 299
-1 votes
1 answer
324 views

Dockers create user namespaces?

My question is about how Docker instrument the storage for the container instance. Do container applications or Docker create user namespaces when creating a new container instance?
Franc's user avatar
  • 299
-2 votes
1 answer
752 views

How to create a user namespace in Ubuntu?

I want to create namespaces with and without the privilege and need to study the implications if the namespace creation is restricted only for the privileged users. How to create a user namespace in ...
Franc's user avatar
  • 299
0 votes
0 answers
180 views

How to expand the number of subuids for a linux namespace

After running something like this: $ unshare -rUm $ mkdir opt $ mount --bind opt /opt $ touch /opt/test $ chown 1000:1000 /opt/test I'm receiving this: chown: changing ownership of '/opt/test': ...
Marius's user avatar
  • 1
2 votes
0 answers
101 views

How to mount folders on a per-process basis while keeping all functionalities of regular shell

In order to fake a FHS OS on a non-FHS OS (NixOs) and to increase "purity", I need to mount some folders and overlay other folders in a per-process basis, for instance /lib does not exists ...
tobiasBora's user avatar
  • 4,301
0 votes
0 answers
1k views

How do I start a Docker container in custom network namespace?

How do I make docker run to setns to the network namespace of my choice when starting a container? I want something like --net host mode, but aiming to the namespace of Docker server itself. Or should ...
Vi.'s user avatar
  • 5,813
2 votes
1 answer
860 views

Unshare with overlayfs results in permission denied with su

I am trying to setup 'rootless' containers by hand, with just unshare and mounting overlayfs. Currently, I can unpack a rootfs tarball, setup a /tmp and /proc mount, and pivot_root/chroot into it ...
Zameer Manji's user avatar
1 vote
0 answers
190 views

Display and follow mount namespace tree peer group IDs

Linux has mount namespaces for process-scoped mount trees via the "shared subtrees" feature. When you examine /proc/$pid/mountinfo of processes in a parent/child mount namespace, you can see ...
Craig Ringer's user avatar
1 vote
1 answer
1k views

echo to gid_map fails but uid_map success

I'm trying to map the user and group ids in new namespace by writing to uid_map and gid_map files. So on terminal-1 I'm doing vaibhav@vaibhav:~$ unshare -U /bin/sh $ id uid=65534(nobody) gid=65534(...
Vaibhav.c's user avatar
  • 133
3 votes
1 answer
1k views

IPv6 forwarding doesn't work in a network namespace

I have 3 Linux VMs connected like this: / server1 \ | ens19 2001:1::2 | \ / | / \ | ens19 2001:1::1 | | ...
Chris's user avatar
  • 33

1
2 3 4 5 6