Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

How do I start a Docker container in custom network namespace?

How do I make docker run to setns to the network namespace of my choice when starting a container? I want something like --net host mode, but aiming to the namespace of Docker server itself. Or should ...
user avatar
  • 5,126
0 votes
0 answers
26 views

Unshare with overlayfs results in permission denied with su

I am trying to setup 'rootless' containers by hand, with just unshare and mounting overlayfs. Currently, I can unpack a rootfs tarball, setup a /tmp and /proc mount, and pivot_root/chroot into it ...
user avatar
0 votes
0 answers
18 views

Bind mount across mount namespaces with disjoint roots

I want to bind-mount the root of one mount namespace as a subdirectory of another mount namespace's root. I'm having two problems doing so: How to refer to one root from a process in the other root ...
user avatar
1 vote
0 answers
14 views

Display and follow mount namespace tree peer group IDs

Linux has mount namespaces for process-scoped mount trees via the "shared subtrees" feature. When you examine /proc/$pid/mountinfo of processes in a parent/child mount namespace, you can see ...
user avatar
1 vote
1 answer
33 views

echo to gid_map fails but uid_map success

I'm trying to map the user and group ids in new namespace by writing to uid_map and gid_map files. So on terminal-1 I'm doing vaibhav@vaibhav:~$ unshare -U /bin/sh $ id uid=65534(nobody) gid=65534(...
user avatar
  • 108
2 votes
1 answer
82 views

IPv6 forwarding doesn't work in a network namespace

I have 3 Linux VMs connected like this: / server1 \ | ens19 2001:1::2 | \ / | / \ | ens19 2001:1::1 | | ...
user avatar
  • 23
0 votes
1 answer
902 views

Podman errors on tar with potentially insufficient UIDs or GIDs available in user namespace

When I run podman run I'm getting a particularly weird error, ❯ podman run -ti --restart=unless-stopped -p 80:80 -p 443:443 rancher/rancher:latest ✔ docker.io/rancher/rancher:latest Trying to pull ...
user avatar
  • 22.4k
1 vote
0 answers
25 views

Real-Time Priority in the user namespace

I have a small program starting a thread with realtime priority in a user-namespace. But every time I want to start it, I get an errno "Permission denied". The program: #include <stdio.h&...
user avatar
  • 11
0 votes
1 answer
42 views

Can't access directory from netns

I created a simple test netns : sudo ip netns add test Then I brought up the lo interface. I'm currently in the home directory of user1, and by executing sudo ip netns exec test ls -la I see all the ...
user avatar
  • 1
2 votes
2 answers
45 views

Is cgroup a type of namespace?

Is cgroup a type of namespace? I am asking this because I have seen blogs talking as if cgroup and namespaces are different. However, in different linux commands , cgroup is considered as a type of ...
user avatar
  • 1,181
1 vote
1 answer
73 views

How can I use a bind mount in a network namespace?

I have an app I run in a network namespace. This works well. I want to run the app multiple times, in different namespaces. For convenience, I want to bind mount the app's working directory to ...
user avatar
  • 165
1 vote
0 answers
58 views

pivot_root() in user namespace fails with EINVAL

I want to isolate a potentially dangerous process, without needing root privileges. However, the syscall pivot_root fails with EINVAL. struct clone_args ca = { .flags = CLONE_NEWUSER | CLONE_NEWNS,...
user avatar
  • 11
2 votes
1 answer
198 views

Is it possible to access a Unix socket over the network?

The documentation of the Linux sandboxing application firejail says whenever we are dealing with X11 we also need to install a new network namespace. This is the only way to block access to the ...
user avatar
  • 233
0 votes
0 answers
33 views

Is there a way to create a namespace to be able to unmount root folder (to uncover early boot environment)?

I'm on a quest to access /cow/upper when Linux is booted from liveUSB $ mount | grep over /cow on / type overlay (rw,relatime,lowerdir=filesystem.squashfs,upperdir=/cow/upper,workdir=/cow/work) ...
user avatar
-1 votes
1 answer
81 views

How to block the internet access but allow local host connection in a process

I have a python program with 2 process running in docker: my own server listening at 8080 an application listening at 8000 I am trying to block the internet access for the 2nd process. I was able to ...
user avatar
  • 11
0 votes
0 answers
42 views

Kill all processes spawned by python script

I want to run a python script, that spawns for example Google Chrome. It should return an error if script fails. I tried to use systemd-run --scope --collect python script.py, but without a success - ...
user avatar
0 votes
2 answers
55 views

How to list open internet connections in a firejail?

I'm using firejail to sandbox firefox. When I use lsof -i, there are no connections shown. Firejail does namespace isolation on the process, so i do this ps aux | grep firefox | awk ' { print $2} ' | ...
user avatar
2 votes
0 answers
50 views

How do I report the max RSS of a cgroup?

I would like to monitor the peak RSS a cgroup has used since it was created. By "peak RSS" I mean: the sum of all processes' RSS at the point in time where that sum is the greatest. I ...
user avatar
1 vote
1 answer
149 views

Unshare with --mount-proc creates a new mnt namespace

I am a little confused about what --mount-proc does when used with unshare command. When I use unshare -fp --mount-proc bash, I notice that it results in both a new PID namespace and a new MNT ...
user avatar
3 votes
1 answer
362 views

why non root user cannot unshare pid namespace?

unshare -pf bash fails with operation not permitted without effective root. If I don't mount proc, mount ns is not needed. Is there any particular reason creating pid ns is not allowed?
user avatar
2 votes
0 answers
40 views

Problem with ksh namespaces defined inside functions

I'm new to ksh namespaces. The problem I'm seeing is that if I define a namespace inside a function, then variables defined within that namespace clobber the same-named variables outside the namespace ...
user avatar
  • 21
2 votes
0 answers
63 views

How one can limit a user to a specific network namespace?

Suppose I have a Linux host with a few non-default network namespaces. I need to limit a specific user to a specific network namespace based on the results of user authentication. For example: user1 ...
user avatar
1 vote
1 answer
225 views

How to move interface into nonstandard network namespace as unprivileged user

I have a Linux network namespace bind mounted at ~/mynamespace as follows: unshare -mrn; touch ~/mynamespace; # executed in the console opened by the first command unshare --net=~/mynamespace true; # ...
user avatar
0 votes
1 answer
128 views

Can't get sound to work in namespace

I am trying to get sound to work in a linux network namespace (+) Audio --aid=1 (mp3 2ch 44100Hz) ALSA lib pcm_dmix.c:1090:(snd_pcm_dmix_open) unable to open slave [ao/alsa] Playback open error: No ...
user avatar
2 votes
1 answer
100 views

In a user namespace as non-root, on a nosuid,nodev filesystem, why does a bind mount succeed but a remount fails?

In a Linux user namespace, as non-root, I bind mount /tmp/foo to itself. This succeeds. Then, I try to remount /tmp/foo to be read-only. If /tmp is mounted with nosuid or nodev, then the remount ...
user avatar
  • 1,226
0 votes
1 answer
123 views

Forward only LAN traffic from network namespace to root namespace

I set up my machine going by the tutorial here to make a Wireguard interface the only interface (so any of my applications can only use that to access the internet). This works as intended, but now I ...
user avatar
0 votes
2 answers
106 views

Does linux have a single parent root file system?

I was reading up on this and my initial (incorrect) thought was that it was to do with mount namespaces and chroot. It got me wondering... I know that if no process exists with access to a file ...
user avatar
  • 154
5 votes
1 answer
398 views

How are time namespaces supposed to be used?

I thought I could do something like: sudo unshare -T bash -c 'date -s "$1" && foobar' sh "$(date -d -1day)" so foobar would see a different system time from the rest of ...
user avatar
  • 4,072
5 votes
1 answer
313 views

How can a process detect that it's in a child namespace?

I have researched the subject and found the following code on Github, which says: // HasNamespace determines if a container is using a particular namespace or the // host namespace. // The device ...
user avatar
  • 3,277
0 votes
0 answers
82 views

Connect namespace to internet using Second public ip address

I have an Ubuntu18 server with Two public addresses How can i create a namespace and connect to the internet through the second public ip? (need to launch a program and force it to use the second ip ...
user avatar
2 votes
1 answer
187 views

Why is the UTS namespace isolation not working?

1. Starting a shell process under a separate child UTS namespace sudo unshare -f --mount-proc -u /bin/bash 2. Change the hostname in this process hostnamectl set-hostname newhostname 3. Monitor the ...
user avatar
2 votes
1 answer
431 views

systemd protecting /proc: ProtectProc and ProcSubset

I am trying to use systemd's ProtectProc and ProcSubset directives to hide "other" processes from the caller: # systemd-run --wait -p ProtectProc=invisible -p ProcSubset=pid --pty --collect ...
user avatar
2 votes
0 answers
807 views

Can systemd-networkd handle interfaces in network namespace?

I'm trying to configure systemd-networkd on an embedded system where wlan0 is in a separate network namespace. I'd like for systemd to configure and monitor the interaface so that related services ...
user avatar
1 vote
1 answer
182 views

How to correctly setup DNS for a macvlan in a namespace (ping IP works, ping URL does not)?

I have set up macvlan in a namespace on a server. I can ping accross default namespace and macvlan namespace, i can even ping the macvlan namespace from any other client in the LAN. But DNS is not ...
user avatar
  • 295
2 votes
1 answer
323 views

How to assign a name to the existing anonymous network namespace

I have a Linux process that creates a network namespace without registering it in /run/netns. The process has also own PID namespace. The network namespace does not have a name and I can see only id ...
user avatar
2 votes
1 answer
48 views

Run gnome-terminal in namespace

I enter a namespace with unshare --net --mount. When I run xterm in it, the shell in the windows that opens iherits the stuff from the namespace. When I run gnome-terminal it runs like I opened it ...
user avatar
  • 277
1 vote
1 answer
124 views

Why I mount --bind --make-private /etc/hosts in new namespace, modification of this file with vim in old namespace will also affect the new ns?

I want to create a new namespace with a different /etc/hosts, so I tried to use mount --bind with unshare to create it as referenced in this answer: https://unix.stackexchange.com/a/242830/271204 # ...
user avatar
0 votes
0 answers
153 views

How does rootless podman attach to user namespaces?

In this question I get an answer which points to man 2 setns, In order to reassociate itself with a new network, IPC, time, or UTS namespace, the caller must have the CAP_SYS_ADMIN capability both in ...
user avatar
  • 22.4k
0 votes
1 answer
232 views

Can I use rootless podman with regular user-namespaces (created outside of podman)?

If I create a uts namespace using unshare and set the hostname to foo, $ unshare --map-root-user --uts /bin/sh # echo $$ 31882 # readlink /proc/31882/ns/uts uts:[4026532825] # hostname foo How can I ...
user avatar
  • 22.4k
2 votes
2 answers
563 views

Is it possible to check the process id of child in different pid namespace?

Is it possible to find the PID of the child process which is in a separate PID namespace? I am able to get the child process PID with respect to the parent namespace but I need to find the PID of the ...
user avatar
0 votes
1 answer
183 views

How to spawn each child process in separate pid namespace

How to spawn each child in a separate PID namespace using unshare (without CLONE_NEWPID flag in child process clone syscall). I am able to successfully spawn first child in PID namespace but I am not ...
user avatar
0 votes
1 answer
158 views

How to connect two instances of netcat through a veth device pair?

I want to connect to instances of netcat through a veth(4) device pair. Thus, I create the veth pair using ip as follows: ip link add eth0 type veth peer name eth1 ip addr add 10.0.0.1/24 dev eth0 ip ...
user avatar
  • 3,277
3 votes
0 answers
53 views

Which namespaces are the executable specified by `release_agent` executed in, when the last task leaves the cgroup?

Reading the documentation for Linux cgroups, I've come across the notify_on_release flag and how it relates to release_agent, i.e. the kernel runs the executable specified by release_agent, if ...
user avatar
  • 3,277
2 votes
1 answer
99 views

How can setuid program abuse the hostname?

A pargraph from https://lwn.net/Articles/531381/ "Another possibility is that a set-user-ID application might be using the hostname as part of the name of a lock file. If an unprivileged user ...
user avatar
  • 157
4 votes
1 answer
370 views

Why do bind mounts of device nodes break with EACCES in root of a tmpfs?

A common scenario for setting up a container/sandbox is wanting to create a minimal set of device nodes in a new tmpfs (rather than exposing the host /dev), and the only (unprivileged) way I know to ...
user avatar
0 votes
2 answers
87 views

How can I test that a buildah script is run under buildah-unshare?

If I have a script that uses buildah mount. I use the same way the docs specify, mnt=$(buildah mount $ctr) If I invoke my script sh ./build.sh, I get cannot mount using driver overlay in rootless ...
user avatar
  • 22.4k
0 votes
2 answers
317 views

Why won't --uts=private allow me to set the hostname?

If I launch a container --uts=private, I still can't change the hostname. But it sounds like this is exactly what this is supposed to be for? What does --uts=private do? $ podman run -ti --uts=private ...
user avatar
  • 22.4k
3 votes
1 answer
137 views

How does --hostname work with `buildah run`?

Give the example here which has an attempt at setting the hostname to foo.bar.baz for the duration of the build, #!/bin/bash ctr=$(buildah from alpine:3) buildah run --hostname 'foo.bar.baz' $ctr /bin/...
user avatar
  • 22.4k
2 votes
1 answer
970 views

Why is it possible to create other namespaces without real root using user namespaces?

When using the command unshare to create namespaces, if you are not the root in the host machine and creating any namespace but the user type, you will receive this error: Operation not permitted. ...
user avatar
1 vote
0 answers
2k views

hostnamectl fails with “Connection timed out” when running inside a systemd-nspawn container

I’m using systemd-nspawn and qemu-arm-static to boot into a Raspberry Pi OS image to apply customizations to the stock image before flashing it onto an SD card. The host machine is Ubuntu 20.10 (...
user avatar
  • 111

1
2 3 4 5