Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
1
vote
0answers
23 views

How to use host PTY in container?

I'm learning about container technologies of Linux and wrote a minimal container implementation on my own. I'm currently confused about consoles / terminals for container processes, as I'm "reusing" ...
2
votes
1answer
25 views

Strange behaviour of pivot_root(“.”, “.”) in mount namespace

I'm trying to understand containers and stumbled upon a trick apparently found by the LXC developers, see this runc PR: You can call pivot_root(".", ".") which avoids the need for a directory to put ...
1
vote
1answer
63 views

How to check the device number of a device in `/proc/1/ns/{ns}`?

How to check the device number of a device in /proc/1/ns/{ns}? I've read the code for a Go library (see below), which states that it's possible to determine, if a container is in the host namespace ...
3
votes
1answer
2k views

running a process in another namespace

I would like to run a new process (for example an xterm) in another network namespace. This could be done like this: sudo ip netns exec otherns sudo -u $USER xterm This command looks a bit ...
1
vote
2answers
2k views

Internet connectivity using linux network namespace

I experimenting with Linux namespaces on Ubuntu 17.1 distro. Ultimate goal is to force an application to use a particular network interface via a 3G modem not the intranet wired connection. My PC has ...
5
votes
1answer
997 views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
0
votes
0answers
35 views

Running multiple isolated NFS Servers

I have a computer on my network which I want to run multiple NFS servers on. Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export ...
0
votes
1answer
26 views

Connect SSH in UTS namespace (host-name namespace) in Ubuntu VM from host Windows

I've an assignment for school to research about namespaces. For all of them I've made examples but UTS is not simple to demonstrate. I've read UTS namespace is often used in vservers for admin ...
27
votes
4answers
20k views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
0
votes
1answer
103 views

Extra mount points for systemd service

I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat ...
0
votes
1answer
49 views

Unable to ping external network from namespace, probably postrouting not working

I'm trying to ping an external ip (in this case google) from inside a network namespace. ip netns add ns1 # Create v-eth1 and v-peer1: v-eth1 is in the host space whereas peer-1 is supposed to be ...
2
votes
1answer
268 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net (sym) links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to ...
0
votes
0answers
44 views

Is there a way to give a user access to a file without adding it to sudoers?

My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter. The usual ...
4
votes
0answers
70 views

When does Linux “garbage-collect” namespaces?

My current understanding of Linux (kernel) namespaces is that their lifetime after creation is as long as at least one of the following conditions holds true: at least one process/thread is joined (...
5
votes
2answers
2k views

What is the NSFS filesystem?

The kernel contains a filesystem, nsfs. snapd creates a nsfs mount under /run/snapd/ns/<snapname>.mnt for each installed snap. ls shows it as a 0 byte file. The kernel source code does not seem ...
11
votes
4answers
3k views

Is it possible to run 'unshare -n [program]' as an unprivileged user?

I want to run a program without any internet access, e.g. unshare -n ping 127.0.0.1. As an unprivileged user, it returns Operation not permitted, as a privileged user, it returns the desired ...
6
votes
0answers
254 views

How can I make a device available inside a systemd-nspawn container with user namespacing?

I would like to mount an encrypted image file using cryptsetup inside a systemd-nspawn container. However, I get this error message: [root@container ~]# echo $key | cryptsetup -d - open luks.img luks ...
5
votes
2answers
365 views

How do I find all interfaces that have been configured in Linux, including those of containers?

I know that you can display interfaces by doing ip a show. That only displays the interfaces that the host can see, but virtual interfaces configured by containers don't appear in this list. I've ...
0
votes
1answer
70 views

What is the old_root concept in pivot_root?

From man 2 pivot_root pivot_root() moves the root file system of the current process to the directory _put_old_ and makes _new_root_ the new root file system of the current process. int ...
2
votes
2answers
101 views

How to find total active namespaces in linux?

Is there any way to find how many active namespaces of each type are present in Linux? Such as: mount ns: 20 net ns: 40 etc.
1
vote
1answer
213 views

systemd “Failed to set up mount namespacing” in Docker container

I recently updated a Docker that uses systemd internally from Debian stretch to Debian buster. And since then it's not working. So accoding to systemctl status it fails to setup the namespace: Dec ...
8
votes
2answers
2k views

View/manipulate mount namespaces in Linux

Is there any way to view or manipulate the mount namespace for an arbitrary process? For example, a docker container is running which has a local mount to an NFS server. It can be seen from inside ...
2
votes
1answer
967 views

Is Traffic control inside namespace on ports created by OpenvSwitch supported?

I am trying to limit the bandwidth of an interface inside a namespace using tc without much success. Seems it's not supported according to https://lists.linux-foundation.org/pipermail/containers/2009-...
0
votes
1answer
26 views

Estimate number of LOC of namespaces implementation and bpf implementation

How can I estimate the LOC of a linux component? In this case I would compare the LOC number that implement namespaces with the number of LOC which implement BPF.
0
votes
0answers
60 views

ip netns list-id show nsid number keep increase

We built a system with two containers. Both containers have network configuration, the config file of the container will be list below. Issue: When two containers startup, use ip netns list-id, it ...
25
votes
5answers
28k views

how to find out namespace of a particular process?

I already asked a question about how to list all namespaces in Linux, but there wasn't any correct and exact answers, so I want to find out a method which can help me to find out the namespace of PID ...
1
vote
2answers
177 views

Sourced Bash script, each with main function

I am using Bash 4.4.20. I typically have main function in each bashscript. If I want to source this script from another function inside another bash script, will this conflict with the main function ...
1
vote
0answers
18 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
0
votes
0answers
30 views

Why does user_namespace isolate the root directory?

User namespaces isolate [...] the root directory [...]. http://man7.org/linux/man-pages/man7/user_namespaces.7.html I thought root is more of a concept like we build houses on the floor. So if I ...
2
votes
0answers
21 views

Is there a standard namespace for local definitions of multi-key characters in the ~/.XCompose file?

I want to add some personal definitions to my ~/.XCompose file, but I don't want them to conflict with any official definitions (especially those that appear in the future and aren't defined yet). Is ...
3
votes
0answers
114 views

I can ping across namespaces, but not connect with TCP

I'm trying to set up two network namespaces to communicate with eachother. I've set up two namespaces, ns0 and ns1 that each have a veth pair, where the non-namespaced side of the veth is linked to a ...
3
votes
1answer
160 views

InterVLAN between namespaces using a third namespace as a router [closed]

I need to establish connection between 2 namespaces (one has ip add 10.0.0.1/24 gateway 10.0.0.254 and the other one has ip add 20.0.0.1/24 gateway 20.0.0.254), separated in different VLANs (10 and 20)...
1
vote
2answers
74 views

What parts of the kernel are not namespace aware? [closed]

I've started to learn Docker security, and so have come across cgroups, namespaces, and capabilities, which together with chroot form the basis of modern container technologies. Historically many ...
1
vote
0answers
124 views

fuse allow_root is not set - why files in user mount is seen via sudo?

Why root can see user files when allow_root is not set by fuse? (user2 get permission denied for ls /media/user1/Data, but can see files via sudo, Linux Mint 19). user2@PC:~$ cat /etc/fuse.conf ... # ...
0
votes
0answers
83 views

How do I route access point traffic through a network namespace using nftables?

First I create a "vpn" network namespace and a veth pair to connect it to the internet via my "ens32" wired ethernet adapter. Then I start openvpn inside the network namespace. Everything in the "vpn" ...
2
votes
0answers
410 views

Docker mapped port doesn't show up on “netstat”, “ss” and “lsof”

I've a question about docker containers and sockets. Today i've discovered that, docker containers with mapped port -p 80:80 (or etc ports) on the host system, doesn't show up when i use netstat, ss ...
2
votes
1answer
99 views

How to find official documentation about Linux kernel namespaces?

I've been using Docker for a while and I'm interested in learning its internals. I've read about kernel namespaces it uses. But I don't understand how they are used. So my problem is: I haven't found ...
1
vote
2answers
166 views

Relation between processes and user namespaces

I'm studying containerization mechanisms. The man page for user namespaces states: "Each process is a member of exactly one user namespace." I'm also trying to follow this article where the author ...
1
vote
1answer
44 views

How are user namespace mappings resolved between namespaces?

Let's say I spawn 2 processes in 2 different namespaces as described by this LWN article. The first one maps UID 0 inside the ns to UID 1000 outside the ns. The second one maps UID 200 inside the ns ...
3
votes
1answer
115 views

How to make /dev inside linux namespaces

AFAIK the container terminology, what I'm essentially trying to accomplish is to write my own "container runtime". What I'm doing: user@host:~$ mkdir test user@host:~$ cd test user@host:~/test$ ...
1
vote
0answers
212 views

Could not display /location “the location is not a folder” error - mount of other user displayed in Nemo file manager

I added another say user2 on Linux Mint system (19.2), logged-on and started X, then Nemo file manager. On the left on Devices expandable list I see links e.g. /media/user1/data (/dev/sda5), when I ...
4
votes
0answers
382 views

Why does `systemd-nspawn -n` network namespace not show in `ip netns list`?

tl;dr Linux has namespaces, in particular, network namespaces. It seems the namespace supposedly created via the -n flag when running systemd-nspwawn does not show up when employing ip netns list (...
3
votes
1answer
952 views

What is the difference between /etc/group and /etc/subgid?

I am in a Docker context and i am using user namespaces to map my container's user into my host's user (let's say foo). As i use portainer (As a container), i need to bind the Docker socket. $ll /var/...
0
votes
1answer
190 views

Why unshare -p does not imply -f and --mount-proc?

The man page specifies that you may be interested in using --fork and --mount-proc when creating a PID namespace, but why those options are not default?
5
votes
2answers
196 views

how to change a file's content for a specific process only?

For the purpose of this question, let us assume that there is a file (/path/to/file) in the filesystem with a certain content like this: $> cat /path/to/file this is the content of the file /path/...
15
votes
3answers
3k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
2
votes
2answers
120 views

What sort of file thing do 'namespace files' point to?

I was poking around /proc/*/ns, and noticed that namespace files look unfamiliar: # example from `man namespaces` $ ls -l /proc/$$/ns total 0 lrwxrwxrwx. 1 mtk mtk 0 Apr 28 12:46 cgroup -> cgroup:[...
2
votes
1answer
217 views

Run ssh daemon in different namespace to connected clients

If sshd is running in the (non-init) namespace of the appropriate physical device: ip netns exec physical sshd is it possible to have clients that connect on that interface get a shell with the ...
1
vote
1answer
422 views

What rule prevents entering a user namespace from inside a chroot?

# rpm -q --whatprovides /usr/bin/unshare util-linux-2.32-2.fc28.x86_64 # unshare -r # i.e. the above succeeds, where the following does not. What rule causes this? # rpm -q --whatprovides /usr/sbin/...
3
votes
0answers
154 views

How to mount files as specific user when using docker namespace remapping?

Problem description: I have a webservice using docker to run nginx and haproxy (among other containers). I want to provide these docker images via a private docker hub registry, and thus don't want ...