LINUX NAMESPACES
🔧 Part 1: Foundations (PID & NET Namespaces)
🔢 PID Namespace — Process Isolation
Isolates the process tree. Each namespace has its own process numbering starting from PID=1.
unshare --pid --fork --mount-proc /bin/bash
Nested namespaces create hierarchical process trees
Processes have multiple PIDs in nested scenarios
Requires --fork flag
cat /proc/PID/status | grep NSpid
🌐 NET Namespace — Network Stack Isolation
Isolates interfaces, routing tables, firewall rules, sockets.
sudo unshare --net /bin/bash
Starts with loopback only
Use veth pairs
Use bridges for LAN
Masquerading for external access
🔐 Part 2: Advanced Namespaces
👤 USER Namespace — UID/GID Mapping
unshare -U /bin/bash
Root inside namespace ≠ root outside
/proc/PID/uid_map
Default UID: 65534
Mapping once per namespace
📁 MNT Namespace — Filesystem Isolation
sudo unshare -m /bin/bash
Mount isolation
MS_SHARED / PRIVATE / SLAVE
/proc/self/mountinfo
pivot_root
🏷 UTS Namespace — Hostname Isolation
sudo unshare -u /bin/bash
hostname change
logging usage
zero overhead
💬 IPC Namespace — IPC Isolation
sudo unshare -i /bin/bash
Isolates semaphores
ipcs -m
clean isolation
⚙️ CGROUP Namespace — Resource View
sudo unshare --cgroup /bin/bash
/sys/fs/cgroup
works with limits
hides host structure
🧬 Building Containers
unshare -U -m -n -p -i -u --fork /bin/sh
USER first
UID mapping
veth networking
pivot_root
🛠 Quick Reference
| Namespace | Flag | Command | Description |
|---|---|---|---|
| PID | --pid | unshare --pid --fork | Process isolation |
| NET | --net | unshare --net | Network stack |
| MNT | --mount | unshare --mount | Filesystem |
| USER | --user | unshare -U | UID mapping |
| UTS | --uts | unshare --uts | Hostname |
| IPC | --ipc | unshare --ipc | IPC isolation |
| CGROUP | --cgroup | unshare --cgroup | Resource view |
🔍 Debugging
ls /proc/$$/ns
readlink /proc/$$/ns/pid
cat /proc/PID/status | grep Ns
⚡️ Pro Tips
Use clone() for advanced control
USER namespace first
veth for networking
pivot_root > chroot
combine with cgroups
Based on Quarkslab Linux Namespaces (Part 1 & 2)