48
votes
How to list namespaces in Linux?
Utilities for working with namespaces have improved since this question was asked in 2013.
lsns from the util-linux package can list all of the different types of namespaces, in various useful ...
- 79.5k
31
votes
How to find out namespace of a particular process?
If you have util-linux v2.28 or above you can use lsns:
# lsns
NS TYPE NPROCS PID USER COMMAND
4026531836 pid 78 1 root /sbin/init
4026531837 user 79 ...
- 804
24
votes
Accepted
How to perform chroot with Linux namespaces?
Entering a mount namespace before setting up a chroot, lets you avoid cluttering the host namespace with additional mounts, e.g. for /proc. You can use chroot inside a mount namespace as a nice and ...
- 51.4k
20
votes
How to find out namespace of a particular process?
ps now has output options for the different types of namespaces associated with processes: ipcns, mntns, netns, pidns, userns, and utsns. For this question, the relevant one is the PID namespace, or ...
- 79.5k
20
votes
Accepted
What is the NSFS filesystem?
As described in the kernel commit log linked to by jiliagre above, the nsfs filesystem is a virtual filesystem making Linux-kernel namespaces available. It is separate from the /proc "proc" filesystem,...
- 1,337
19
votes
Accepted
Is it possible to run 'unshare -n [program]' as an unprivileged user?
In later versions of util-linux, unshare gained the --map-root-user option. Quoting from unshare(1) version 2.26.2:
-r, --map-root-user
Run the program only after the current effective user and ...
- 1,731
18
votes
Accepted
Why can't I bind-mount "/" inside a user namespace?
The difference is that / has child mounts. Inside a user namespace, you are not allowed to separate inherited mounts from their child mounts. A more obvious example is that you are not allowed to ...
- 51.4k
14
votes
Accepted
Losing permissions by adding capability?
What's happening here is that your "unshare" process does not have access to write to the setgroups (and uid_maps, gid_maps) files on the external user namespace.
In that namespace, the pseudo-files ...
- 22.1k
12
votes
Namespace management with ip netns (iproute2)
You have two questions in one:
what are the empty files in /var/run/netns/?
how to use /etc/netns/ which doesn't even exist?
What are the empty files in /var/run/netns/?
Some understanding of ...
- 37.6k
11
votes
Accepted
Switching into a network namespace does not change /sys/class/net?
Let's look into man 5 sysfs:
/sys/class/net
Each of the entries in this directory is a symbolic link representing
one of the real or virtual networking devices that are visible in
the ...
- 1,272
11
votes
What is the NSFS filesystem?
That's the "Name Space File System", used by the setns system call and, as its source code shows, Name Space related ioctl's (e.g. NS_GET_USERNS, NS_GET_OWNER_UID...)
NSFS pseudo-files entries used ...
- 61.9k
10
votes
Accepted
Why do bind mounts of device nodes break with EACCES in root of a tmpfs?
Well, this seems to be a very interesting effect, which is a consequence of three mechanisms combined together.
The first (trivial) point is that when you redirect something to the file, the shell ...
- 1,272
10
votes
Accepted
Podman errors on tar with potentially insufficient UIDs or GIDs available in user namespace
In order to get around this I had to run --storage-opt ignore_chown_errors=true this ignores chmod errors and forces your container to only support one user. You can read about this in "Why can’t ...
- 32.4k
9
votes
Separate DNS configuration in each network namespace
Solution
You can use ip netns exec with bash instead of using nsenter, i.e.:
ip netns exec [namespace name] bash
This will allow you to enter an interactive shell session where the namespace-specific ...
- 10k
9
votes
Accepted
Unable to create user namespace in RHEL
If one uses strace to inspect the command
$ strace -o logf -f unshare -U sh
unshare: unshare failed: Invalid argument
$ grep 'Invalid argument' logf
31728 unshare(CLONE_NEWUSER) = -1 ...
- 35.2k
9
votes
Podman errors on tar with potentially insufficient UIDs or GIDs available in user namespace
The already accepted answer made me go look for a global setting that could produce the same results for all podman invocations. That is pretty important in my case since podman is invoked by another ...
- 91
8
votes
Simulate chroot with unshare
Yes. If your kernel supports user_namespaces (and they are enabled), you can first "simulate the root" user, which then gets the right to invoke chroot (as a real root user). (Which previously needed ...
8
votes
How to make reachable macvlan aliases in a different namespaces?
To complete the accepted answer, the bridge mode is the easiest way to go, but it's not enough to get the communication.
When the jail instance tries to ping the host, it sends an ARP request to get ...
- 37.6k
8
votes
unshare --map-root-user switch to original uid/username after setup
The unshare(1) command can't do it:
-r, --map-root-user
[...] As a mere convenience feature, it does not support more sophisticated use cases, such as mapping multiple ranges
of UIDs and GIDs.
...
- 37.6k
8
votes
Accepted
Understanding how mount namespaces work in Linux
mount namespaces differ in the arrangement of mounted filesystems.
This is very flexible, because mounts can be bind mounts of a sub-directory within a filesystem.
# unshare --mount # run a shell ...
- 51.4k
8
votes
Accepted
Why does `nsenter` need to call `fork` before `exec` to ensure that any children will also be in the newly entered PID namespace?
The explanation is given in the “PID namespace” section of man nsenter:
Children will have a set of PID to process mappings separate
from the nsenter process.
...
- 451k
8
votes
ping inside netns requires sudo (Fedora)
See related question How does ping work on Fedora without setuid and capabilities?
and Links
https://lwn.net/Articles/422330/
https://fedoraproject.org/wiki/Changes/EnableSysctlPingGroupRange
For ...
- 141
8
votes
Accepted
How can a process detect that it's in a child namespace?
I can share what I found out some time ago when I researched the subject myself. It's certainly not authoritative nor exhaustive but it may be of some help.
Technical description
Disclaimer note
I ...
- 5,478
7
votes
What's a UTS namespace?
In short, the UTS namespace is about isolating hostnames.
The UTS namespace is used to isolate two specific elements of the system that relate to the uname system call. The UTS(UNIX Time Sharing) ...
- 171
7
votes
how to change a file's content for a specific process only?
Yes, mount namespaces is one approach:
$ cat file
foo
$ cat other-file
bar
$ sudo unshare -m zsh -c 'mount --bind other-file file; USERNAME=$SUDO_USER; cat file'
bar
$ cat file
foo
Above using zsh ...
- 559k
7
votes
Accepted
Why does unshare based killing only work reliably with --fork?
As described in this helpful answer the effects of -n (unshare(CLONE_NEWPID)) only come into acction for the first child process forked.
In particular, man 2 unshare says says about CLONE_NEWPID:
...
- 1,771
7
votes
Accepted
How do I find all interfaces that have been configured in Linux, including those of containers?
An interface, at a given time, belongs to one network namespace and only one. The init (initial) network namespace, except for inheriting physical interfaces of destroyed network namespaces has no ...
- 37.6k
7
votes
Accepted
How are time namespaces supposed to be used?
I see three main points in your reasoning that need clarification:
The first one is that unsharing a time-namespace affects the children spawned from then on by the process that called the unshare(2)....
- 5,478
6
votes
linux namespace, How to connect internet in network namespace?
Think of a network namespace as another computer.
Think of a veth pair as two Ethernet cards with a crossover cable between them.
There are three main ways to connect a network namespace to the ...
- 4,410
6
votes
Accepted
SSH: shell opened in IP namespace
The problem with handling this by changing login shell, as in OP's example, is that when user connects to sshd in the main network namespace then even if you get their shell to run inside another ...
- 749
Only top scored, non community-wiki answers of a minimum length are eligible