Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Configuring network namespace for dedicated IP address

I have a Debian 10 system that is connected to a VPN with Wireguard. I want one application – Tor – running as a service to connect directly to the internet and to have its own IP address in my ...
0
votes
0answers
34 views

Can systemd-networkd handle interfaces in network namespace?

I'm trying to configure systemd-networkd on an embedded system where wlan0 is in a separate network namespace. I'd like for systemd to configure and monitor the interaface so that related services ...
1
vote
1answer
29 views

How to correctly setup DNS for a macvlan in a namespace (ping IP works, ping URL does not)?

I have set up macvlan in a namespace on a server. I can ping accross default namespace and macvlan namespace, i can even ping the macvlan namespace from any other client in the LAN. But DNS is not ...
1
vote
0answers
8 views

How to assign a name to the existing anonymous network namespace

I have a Linux process that creates a network namespace without registering it in /run/netns. The process has also own PID namespace. The network namespace does not have a name and I can see only id ...
0
votes
0answers
22 views

Can otherwise “busy” filesystems be unmounted in a single-process mount namespace?

Suppose a process enters its own mount namespace. It inherits the filesystem mounts that were present in the mount namespace it started out in, but can it now unmount those same filesystems, which are ...
2
votes
1answer
24 views

Run gnome-terminal in namespace

I enter a namespace with unshare --net --mount. When I run xterm in it, the shell in the windows that opens iherits the stuff from the namespace. When I run gnome-terminal it runs like I opened it ...
1
vote
1answer
59 views

Why I mount --bind --make-private /etc/hosts in new namespace, modification of this file with vim in old namespace will also affect the new ns?

I want to create a new namespace with a different /etc/hosts, so I tried to use mount --bind with unshare to create it as referenced in this answer: https://unix.stackexchange.com/a/242830/271204 # ...
0
votes
0answers
19 views

How does the pause process keep namespaces alive?

According to this blog post about podman, Next, Podman creates a pause process to keep the namespace alive, so that all containers can run from the same context and see the same mounts. The next ...
0
votes
0answers
63 views

How does rootless podman attach to user namespaces?

In this question I get an answer which points to man 2 setns, In order to reassociate itself with a new network, IPC, time, or UTS namespace, the caller must have the CAP_SYS_ADMIN capability both in ...
0
votes
1answer
63 views

Can I use rootless podman with regular user-namespaces (created outside of podman)?

If I create a uts namespace using unshare and set the hostname to foo, $ unshare --map-root-user --uts /bin/sh # echo $$ 31882 # readlink /proc/31882/ns/uts uts:[4026532825] # hostname foo How can I ...
1
vote
2answers
65 views

Is it possible to check the process id of child in different pid namespace?

Is it possible to find the PID of the child process which is in a separate PID namespace? I am able to get the child process PID with respect to the parent namespace but I need to find the PID of the ...
1
vote
0answers
18 views

Learning about cgroups and namespace [closed]

Does anyone know of a good way of learn about cgroups and namespaces. Most Linux books do not seem to cover this topic for some reason or the other. In particular I want to be able to control ...
0
votes
1answer
40 views

How to spawn each child process in separate pid namespace

How to spawn each child in a separate PID namespace using unshare (without CLONE_NEWPID flag in child process clone syscall). I am able to successfully spawn first child in PID namespace but I am not ...
0
votes
1answer
29 views

How to connect two instances of netcat through a veth device pair?

I want to connect to instances of netcat through a veth(4) device pair. Thus, I create the veth pair using ip as follows: ip link add eth0 type veth peer name eth1 ip addr add 10.0.0.1/24 dev eth0 ip ...
3
votes
0answers
24 views

Which namespaces are the executable specified by `release_agent` executed in, when the last task leaves the cgroup?

Reading the documentation for Linux cgroups, I've come across the notify_on_release flag and how it relates to release_agent, i.e. the kernel runs the executable specified by release_agent, if ...
2
votes
1answer
76 views

How can setuid program abuse the hostname?

A pargraph from https://lwn.net/Articles/531381/ "Another possibility is that a set-user-ID application might be using the hostname as part of the name of a lock file. If an unprivileged user ...
5
votes
1answer
222 views

Why do bind mounts of device nodes break with EACCES in root of a tmpfs?

A common scenario for setting up a container/sandbox is wanting to create a minimal set of device nodes in a new tmpfs (rather than exposing the host /dev), and the only (unprivileged) way I know to ...
0
votes
2answers
32 views

How can I test that a buildah script is run under buildah-unshare?

If I have a script that uses buildah mount. I use the same way the docs specify, mnt=$(buildah mount $ctr) If I invoke my script sh ./build.sh, I get cannot mount using driver overlay in rootless ...
0
votes
0answers
11 views

Mount directory in mount namespace after pivot_root

Is it possible to bind mount a folder to an unshare'd and pivot_root'ed namespace from outside the current root? I have tried the following naive approach which doesn't work, /tmp from the mnt ...
0
votes
2answers
55 views

Why won't --uts=private allow me to set the hostname?

If I launch a container --uts=private, I still can't change the hostname. But it sounds like this is exactly what this is supposed to be for? What does --uts=private do? $ podman run -ti --uts=private ...
0
votes
0answers
61 views

Creating a sandbox (process isolation) with namespaces in bash

for a personal project, I'm currently trying to create a sandbox with linux namespaces. My goal is to remove access to my original fs, but also to network, hostname, user namespace, PID (etc...) First,...
3
votes
1answer
103 views

How does --hostname work with `buildah run`?

Give the example here which has an attempt at setting the hostname to foo.bar.baz for the duration of the build, #!/bin/bash ctr=$(buildah from alpine:3) buildah run --hostname 'foo.bar.baz' $ctr /bin/...
0
votes
0answers
13 views

unshare --map-user: Why doesn't $USER change?

When i use unshare --map-user=root, the $USER variable changes to "root", but if I pass in any other user, the $USER variable doesn't change. Why?
0
votes
1answer
221 views

Why is it possible to create other namespaces without real root using user namespaces?

When using the command unshare to create namespaces, if you are not the root in the host machine and creating any namespace but the user type, you will receive this error: Operation not permitted. ...
0
votes
0answers
345 views

hostnamectl fails with “Connection timed out” when running inside a systemd-nspawn container

I’m using systemd-nspawn and qemu-arm-static to boot into a Raspberry Pi OS image to apply customizations to the stock image before flashing it onto an SD card. The host machine is Ubuntu 20.10 (...
1
vote
1answer
44 views

Rootless “unshare -m” like bubblewrap?

On my Linux host unshare -m refuse to go without root. Bubblewrap bwrap --dev-bind / / --ro-bind-data xxxx xxxx and bwrap --dev-bind / / --tmpfs doesn't require root. (no setuid on bwrap) How can I ...
0
votes
0answers
40 views

How to enter the root PID namespace from a distribution installed on WSL?

I've been experimenting with the Windows Subsystem for Linux v2 (WSL 2) and read in their FAQ that all distributions are installed on the same virtual machine (VM), isolated using namespaces, in Hyper-...
0
votes
0answers
38 views

How do I start a Docker container in other _host_ network namespace?

docker run --network=host starts a container in the same network namespace as containerd. How do I instead start a container in, for example, /proc/5633/ns/net or other specific network namespace? man ...
0
votes
0answers
28 views

Setting security extended file attribute in nspawn returns “Operation not permitted”

I have built an nspawn container. It starts with the -U (--private-users) option, so creates a user namespace. setfattr -n security.NTACL from the container returns Operation not permitted. The same ...
1
vote
0answers
35 views

Error: Connection activation failed: Failed to find a compatible device for this connection

Hi linux newbie here pardon any mistakes. I have configured a network namespace local-routeTable and have brought up interface eth3 inside the namespace: # ip netns exec local-routeTable ifconfig eth3:...
2
votes
1answer
90 views

ping inside netns requires sudo (Fedora)

Using fedora 32, I launched a shell inside a network namespace using sudo ip netns add net0 sudo ip netns exec net0 sudo -u fred /usr/bin/bash I configured the network links and firewall to enable ...
1
vote
0answers
59 views

how to create FTP server in namespace

Lets say i created two namespace in Ubuntu. ip netns add A ip netns add B now create Macvlan corresponding to each namespaces ip link add macvlanA link wlo1 type macvlan mode bridge ip link set ...
1
vote
1answer
51 views

How to make a namespace visible inside a chrooted/NEWPID process

I create a new process using CLONE_NEWPID and chroot to /mnt/ Outside of that, I create a new netns using the ip netns command. e.g. ip netns add test1 Any idea how can I make the chrooted process, ...
3
votes
1answer
101 views

How can a process hold a capability in another namespace?

I'm brooding over the interactions between namespaces and capabilities. Occasionally, I stumble over wording like the following from user_namespaces(7): Holding CAP_SYS_ADMIN within the user ...
1
vote
1answer
359 views

How can I enable user namespaces and have it persist after reboot?

When I run podman I get, $ podman info cannot clone: Operation not permitted user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone Error: cannot re-exec process How can I ...
0
votes
0answers
42 views

Why do my Send-Q keep getting loaded but nothing come out of it?

I'm currently diagnosing a issue related to packet forwarding. I forward link layer packets to B network namespace and I found that B network namespace didn't reply to them, but I could curl and view ...
0
votes
0answers
14 views

How can multiple cgroup namespaces be merged?

I stumbled upon an interesting cgroup setup and I want to understand how it works. It appeared like two separate Docker containers' cgroups were "merged" into a third cgroup which was a ...
1
vote
0answers
65 views

How to update UID/GID in /etc/passwd and /etc/group when using --private-users=pick with systemd containers

sorry for the stupid question as am noob. I have OpenSuseLeap container on my manjaro Linux, I used to login into it and everything was working. I was happy with the command:- sudo systemd-nspawn -b -...
0
votes
1answer
173 views

Network namespace as a regular user

In linux you can create network namespaces, using the ip command. But you need to be root to run that command. However you can still create network namespaces as a regular user using unshare -rUn. ...
1
vote
1answer
157 views

Can I move mount to other mount namespace

Question : Is there any way I could move/copy mount from one namespace to another? Explanation: I would like to mount directory which didn't exist when container was created. I am creating container. ...
0
votes
0answers
129 views

Create network namespace with full network access [LINUX]

I created a linux namespace using this script : read -p "ip : " ip ip netns add myvpn ip netns exec myvpn ip addr add 127.0.0.1/8 dev lo ip netns exec myvpn ip link set lo up ip link add ...
-1
votes
1answer
260 views

Do user (group) ID mappings in `/proc/[pid]/uid_map` (`/proc/[pid]/gid_map`) only apply for the process `[pid]` or globally for the whole namespace?

After reading man user_namespaces, I'm not sure, whether user (group) ID mappings to the parent namespace, set in /proc/[pid]/uid_map (/proc/[pid]/gid_map), apply to all processes in the namespace or ...
4
votes
1answer
315 views

Why does `nsenter` need to call `fork` before `exec` to ensure that any children will also be in the newly entered PID namespace?

I assume that nsenter, which runs as a sub-process of bash, utilizes the setns system call to join an existing namespace and then executes the specified program using exec. But, if nsenter has ...
3
votes
1answer
385 views

Can subordinate user ID be used to grant file system permissions?

Suppose I have user "myuser" with uid/gid "1001", and files "/etc/subuid" & "/etc/subgid" with the following content: myuser:100000:65536 Can this setup somehow be used to allow user "myuser" to ...
2
votes
2answers
156 views

Environment variables when running unshare

Is there any namespace (process, user, etc) that isolates environment variables? In case there is, what happens when you unshare? Do they get cloned? What happens if a process changes an existing ...
5
votes
0answers
238 views

Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?

I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug? When some process opens /proc/<pid>/net/dev it can ...
1
vote
0answers
93 views

How to use host PTY in container?

I'm learning about container technologies of Linux and wrote a minimal container implementation on my own. I'm currently confused about consoles / terminals for container processes, as I'm "reusing" ...
2
votes
2answers
159 views

Strange behaviour of pivot_root(“.”, “.”) in mount namespace

I'm trying to understand containers and stumbled upon a trick apparently found by the LXC developers, see this runc PR: You can call pivot_root(".", ".") which avoids the need for a directory to put ...
2
votes
1answer
208 views

How to check the device number of a device in `/proc/1/ns/{ns}`?

How to check the device number of a device in /proc/1/ns/{ns}? I've read the code for a Go library (see below), which states that it's possible to determine, if a container is in the host namespace ...
0
votes
0answers
171 views

Running multiple isolated NFS Servers

I have a computer on my network which I want to run multiple NFS servers on. Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export ...

1
2 3 4 5