Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

Virtual interface pair forwarding packets to each other

The goal is very simple: anything sent to pair1, as outgoing packet, should appear on pair0 as an incoming packet and vice versa. I am thinking on a layer3-only, virtual interface now. tun could do ...
peterh's user avatar
  • 9,731
3 votes
1 answer
62 views

Disable namespaces in Linux without compiling

Is there a way to disable all namespace types at boot time or runtime in Linux?
Melab's user avatar
  • 4,048
0 votes
0 answers
40 views

How to forward data via netns exec namespace

I'm using zmq to receive data from another pc. I would like to formard this received data to the Internet via namespace. I've created this python script: import subprocess import zmq context = zmq....
Raúl Parada Medina's user avatar
0 votes
0 answers
10 views

How to get full mountpoint path name by the sturct fc_context

In my kernel module, I've implemented a syscall hook named fsconfig to manage operations related to remounting readonly mountpoints. For instance, if a user executes mount /dev/sda /tmp/mytest -o ...
hongyun's user avatar
1 vote
1 answer
38 views

Can't use user/group IDs in unshared namespace

When mounting a tmpfs in a mount and user namespace that is separate from my 'regular' system, my expectation is that it's possible to use any user/group ID. There would be no need for mapping IDs ...
Banyoghurt's user avatar
2 votes
1 answer
47 views

Cannot close LUKS volume while any flatpak app is running

The problem I cannot cryptsetup close any LUKS volume while any flatpak app is running in the background. Yes, the flatpak app just has to be running in the background, I'm not trying to use ...
renzev's user avatar
  • 111
1 vote
0 answers
27 views

Isolating a child process in a remote desktop program

I'm developing a remote desktop/streaming program for linux. When a user logs in, they specify a program to launch, and the remote server launches that program as a new process. The server process ...
colinmarc's user avatar
  • 111
0 votes
1 answer
85 views

Kubernetes Namespace Stuck in 'Terminating'

I'm encountering an issue where a Kubernetes namespace is stuck in the 'Terminating' state. Running kubectl get ns cattle-monitoring-system -o json|jq produces error messages related to custom.metrics....
karlsebal's user avatar
  • 815
0 votes
0 answers
49 views

What is causing permission denied under proot?

At work I have limited access to my PC, so I am running proot with /nix mounted to give me access to nix package manager. However, executing some setuid commands fails under proot. $ proot /usr/bin/...
KamilCuk's user avatar
  • 860
0 votes
0 answers
84 views

How can I mount a 9p filesystem from an unprivileged user namespace?

I'm trying to mount a 9p filesystem from inside a user namespace. First, I run the 9p server: p9ufs -v --unix '/run/9p/srved' I then use the setuid binary 9mount (https://sqweek.net/code/9mount/) to ...
user589082's user avatar
1 vote
0 answers
141 views

What causes `newuidmap` to be dissallowed in new user namespace?

I expected uid=0(root) gid=0(root) groups=0(root) to be the output of both $ rootlesskit id $ unshare -U bash -c 'newuidmap $$ 0 '"$(id -u)"' 1; id' however the somewhat more verbose -x ...
humanityANDpeace's user avatar
0 votes
0 answers
73 views

systemd kill process and child with SIGTERM

Hi have a very strange scenario when my process (and its child) receives a SIGTERM and the sender is systemd (PID == 1). My setup is the following: two "simmetric" partitions mounted on /...
MirkoBanchi's user avatar
0 votes
1 answer
498 views

How to Make a Systemd Private Network Namespace Accessable

So I have an application that only binds to 0.0.0.0 and listens on a port (TCP). The communication is unencrypted and unauthorized so I'd like to work around that without getting too deep into the ...
WesAtWork's user avatar
0 votes
1 answer
99 views

centos/linux: run tftpd in a non-default net namespace

I wonder if anyone succeeded starting a tftpd in a network namespace (I'm using tftp-server-5.2-22.el7.x86_64.rpm)? I.e., starting tftpd in a default NS is trivial: bash# systemctl start tftp bash# ...
Dmitry's user avatar
  • 73
0 votes
0 answers
82 views

How to control HOST systemd service inside pid namespace

Note: this is not about to run systemd inside namespace/container I need to control some service, from inside a namespace/container, but systemctl returns "Failed to connect to bus: No data ...
GongT's user avatar
  • 11
1 vote
1 answer
224 views

podman running as user dies after hard reboot - Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)

I'm struggling to determine what is going on here. Podman running in user space was running fine, but the server took a hard reboot and now it is... for lack of a more accurate technical assessment, ...
Grant Curell's user avatar
0 votes
1 answer
331 views

Cannot create an NVMe shared namespace and attach it to both primary and secondary controllers

I tried creating a namespace on a Samsung PM1735 NVMe SSD then attach it to primary (0x41) and secondary (0x1) controllers, but it's attaching only to the primary controller (I'm running on Ubuntu 20....
vcr's user avatar
  • 1
1 vote
0 answers
95 views

How to forward packets between net namespaces?

I have a lima VM with linux running Ubuntu 23.04 with kernel 6.2 and cgroupsv2. This VM is meant to serve as docker host. When I create docker network in this VM I get an interface in its own ...
Patryk's user avatar
  • 14.1k
2 votes
1 answer
632 views

Create new process namespace with existing mount namespace

I'm having trouble figuring out how to create a new process namespace once I exit from the one created by unshare. So, for example, I have the following. unshare -f --mount-proc --mount=/containers/1/...
Todd's user avatar
  • 141
0 votes
0 answers
99 views

BSD namespace existence

Does BSD (Free/Net/Open etc.) have namespace implementation in their kernel (like in Linux). Because I did not find any clear explanation on internet.
22EF's user avatar
  • 11
0 votes
0 answers
100 views

NVMe device on my RHEL8 system corrupt?

It seems that the single namespace that was on my NVMe PCIe device is completely gone. I received an email alert from my system which just said: Device: /dev/nvme0, unable to open NVMe device When I ...
Derek Edwards's user avatar
2 votes
1 answer
315 views

Root network namespace as transit between 2 other net namespaces

I am trying to communicate between two network namespaces that are connected through the root namespaces using veth pairs as seen in the diagram. I am unable to perform a ping from netns A to netns B. ...
Rahul Raj Purohit's user avatar
1 vote
0 answers
163 views

How to firewall a network namespace using firewalld?

I'm running fedora 36 using firewalld as my firewall. I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this: ip ...
minamikoarikui's user avatar
3 votes
0 answers
280 views

Use Public IPv4 on Linux Network Namespace

I am using a VPS and gotten an extra IP address. I am trying and failing to assign the second IP address to a separate network namespace. Lets say my main IP and netmask is x.x.133.39/23 and my ...
alou S's user avatar
  • 31
0 votes
1 answer
388 views

systemd service timeout when using sudo

Target I am trying to run a service (transmission-daemon) in a network namespace for VPN usage. The service should automatically start using systemd. Implementation details I am using namespaced-...
HighDraw's user avatar
2 votes
1 answer
368 views

Unable to get a namespace to access the external network

I am running Linux in a VirtualBox environment. I have successfully defined 2 namespaces connected via a bridge that can talk to each other. I want to be able to get UDP packets out onto the actual ...
RD Florida's user avatar
1 vote
0 answers
308 views

Explanation of details in SOURCE column of findmnt

I have some questions regarding the output of the "findmnt" command, specifically the SOURCE column: TARGET SOURCE FSTYPE ...
Jared's user avatar
  • 11
0 votes
0 answers
182 views

Forward traffic from public IP to namespace

I have two VMs VM-A & VM-B connected via IPIP Tunnel in a namespace. I want the application in VM-B which is under namespace to be accessed from the public IP of VM-C. Can someone help me how can ...
ph3ro's user avatar
  • 378
4 votes
1 answer
1k views

What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?

While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
Dejan Zelic's user avatar
0 votes
1 answer
121 views

Fix Polyinstantiation of /tmp causing 'connect /tmp/.X11-unix/X0: No such file or directory'

In a multiseat desktop system with the /tmp directory polyinstantiated, the /tmp/.X11-unix/ directory and Xn instances are still created under root's /tmp not a user's. ssh -Ying into or out of the ...
SHawarden's user avatar
  • 554
1 vote
1 answer
1k views

Why is my namespace not detected?

I tried form home,then sudo su - ip netns exec 5bd337503b01 ip addr show Cannot open network namespace "5bd337503b01": No such file or directory pwd shows /var/run/docker/netns Why?
Richard Rublev's user avatar
0 votes
0 answers
34 views

Why is the default NameSpace of pid always 4026531836 [duplicate]

Why is the default NameSpace of pid always 4026531836. Whats special about this number?
Nagri's user avatar
  • 215
4 votes
1 answer
850 views

How do you get the child pid of `unshare` when using --fork for `nsenter -t <pid>`?

When using unshare --pid --fork, the nsenter command must attach to the child pid not the unshare pid to get to the right pid namespace. I can get unshare's pid as follows: unshare --pid --mount --...
KJ7LNW's user avatar
  • 485
2 votes
2 answers
667 views

Why is the Linux command `unshare --pid=p --mount=m` not creating a persistent namespace?

From everything I have read in the unshare and nsenter man pages, I should be able to bind-mount a directory to itself, mount --make-private the directory, and then use files within that directory to ...
KJ7LNW's user avatar
  • 485
1 vote
1 answer
230 views

If ports are unpriviledged, why can't I access them if I am root in a namespace?

I've run sudo sysctl -w net.ipv4.ip_unprivileged_port_start=1. However, sudo ip netns exec myvpn unshare -r python -m http.server -b 127.0.0.1 2 does not work. Strangely enough, this does: sudo ip ...
DrownedSuccess's user avatar
8 votes
1 answer
981 views

How does /proc interact with PID namespaces?

I do not understand how namespaces interact with /proc. I assumed that /proc returns values based on the process that queries them. For example, let's determine the PID of the current process inside ...
Georg Schölly's user avatar
0 votes
1 answer
417 views

How to login to a user namespace created by unshare?

How to login to a user namespace created by unshare -U from another terminal?
Franc's user avatar
  • 289
-1 votes
1 answer
311 views

Dockers create user namespaces?

My question is about how Docker instrument the storage for the container instance. Do container applications or Docker create user namespaces when creating a new container instance?
Franc's user avatar
  • 289
-2 votes
1 answer
666 views

How to create a user namespace in Ubuntu?

I want to create namespaces with and without the privilege and need to study the implications if the namespace creation is restricted only for the privileged users. How to create a user namespace in ...
Franc's user avatar
  • 289
0 votes
0 answers
166 views

How to expand the number of subuids for a linux namespace

After running something like this: $ unshare -rUm $ mkdir opt $ mount --bind opt /opt $ touch /opt/test $ chown 1000:1000 /opt/test I'm receiving this: chown: changing ownership of '/opt/test': ...
Marius's user avatar
  • 1
2 votes
0 answers
87 views

How to mount folders on a per-process basis while keeping all functionalities of regular shell

In order to fake a FHS OS on a non-FHS OS (NixOs) and to increase "purity", I need to mount some folders and overlay other folders in a per-process basis, for instance /lib does not exists ...
tobiasBora's user avatar
  • 4,051
0 votes
0 answers
1k views

How do I start a Docker container in custom network namespace?

How do I make docker run to setns to the network namespace of my choice when starting a container? I want something like --net host mode, but aiming to the namespace of Docker server itself. Or should ...
Vi.'s user avatar
  • 5,688
2 votes
1 answer
788 views

Unshare with overlayfs results in permission denied with su

I am trying to setup 'rootless' containers by hand, with just unshare and mounting overlayfs. Currently, I can unpack a rootfs tarball, setup a /tmp and /proc mount, and pivot_root/chroot into it ...
Zameer Manji's user avatar
1 vote
0 answers
176 views

Display and follow mount namespace tree peer group IDs

Linux has mount namespaces for process-scoped mount trees via the "shared subtrees" feature. When you examine /proc/$pid/mountinfo of processes in a parent/child mount namespace, you can see ...
Craig Ringer's user avatar
1 vote
1 answer
1k views

echo to gid_map fails but uid_map success

I'm trying to map the user and group ids in new namespace by writing to uid_map and gid_map files. So on terminal-1 I'm doing vaibhav@vaibhav:~$ unshare -U /bin/sh $ id uid=65534(nobody) gid=65534(...
Vaibhav.c's user avatar
  • 133
3 votes
1 answer
1k views

IPv6 forwarding doesn't work in a network namespace

I have 3 Linux VMs connected like this: / server1 \ | ens19 2001:1::2 | \ / | / \ | ens19 2001:1::1 | | ...
Chris's user avatar
  • 33
6 votes
2 answers
17k views

Podman errors on tar with potentially insufficient UIDs or GIDs available in user namespace

When I run podman run I'm getting a particularly weird error, ❯ podman run -ti --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher:latest ✔ docker.io/rancher/rancher:latest Trying to pull ...
Evan Carroll's user avatar
  • 30.9k
1 vote
0 answers
214 views

Real-Time Priority in the user namespace

I have a small program starting a thread with realtime priority in a user-namespace. But every time I want to start it, I get an errno "Permission denied". The program: #include <stdio.h&...
Mario's user avatar
  • 11
0 votes
1 answer
786 views

Can't access directory from netns

I created a simple test netns : sudo ip netns add test Then I brought up the lo interface. I'm currently in the home directory of user1, and by executing sudo ip netns exec test ls -la I see all the ...
eric's user avatar
  • 1
2 votes
2 answers
569 views

Is cgroup a type of namespace?

Is cgroup a type of namespace? I am asking this because I have seen blogs talking as if cgroup and namespaces are different. However, in different linux commands , cgroup is considered as a type of ...
Ahmad Ismail's user avatar
  • 2,678

1
2 3 4 5 6