Namespaces

Unshare

Mount namespace

Isolates filesystem mount points

unshare --mount bash
cat /proc/self/mountinfo
mount --bind /some/dir /mnt

PID namespace

Isolates process ID numbering (requires --fork)

unshare --pid --fork bash
mount -t proc proc /proc
ps aux

Network namespace

Isolates network stack (interfaces, routes, iptables)

unshare --net bash
ip link
ip link set lo up

Connect two netns via veth

ip netns add ns1
ip link add veth0 type veth peer name veth1
ip link set veth1 netns ns1
ip netns exec ns1 ip addr add 10.0.0.1/24 dev veth1
ip netns exec ns1 ip link set veth1 up
ip addr add 10.0.0.2/24 dev veth0
ip link set veth0 up

IPC namespace

Isolates System V IPC and POSIX message queues

unshare --ipc bash
ipcs

UTS namespace

Isolates hostname and domainname

unshare --uts bash
hostname <newname>
hostname

User namespace

Isolates UID/GID mappings

unshare --user bash
whoami
id

Map to root inside namespace

unshare --map-root-user bash
whoami
id

Cgroup namespace

Isolates cgroup root hierarchy

unshare --cgroup bash
cat /proc/self/cgroup

Time namespace

Isolates system time (boot time, monotonic clocks)

unshare --time bash

Combined namespaces

Minimal container environment

unshare --mount --pid --net --ipc --uts --fork --mount-proc bash
hostname container1
ip link set lo up
mount -t proc proc /proc

Nsenter

Join an existing namespace

nsenter --target <PID> --mount --pid bash
nsenter --target <PID> --net bash
nsenter --target <PID> --all bash

Lsns

List and inspect namespaces

lsns
lsns -t net
lsns -p <PID>
lsns -J

/proc/<PID>/ns/

Inspect namespace membership of a process

ls -l /proc/<PID>/ns/
cat /proc/<PID>/uid_map
cat /proc/<PID>/gid_map
cat /proc/<PID>/setgroups

User namespace UID/GID mapping

Write mapping to gain privileges inside user namespace

echo '0 <outside_uid> 1' > /proc/self/uid_map
echo '0 <outside_gid> 1' > /proc/self/gid_map
echo 'deny' > /proc/self/setgroups

Persistent namespaces

Create a named network namespace that outlives the process

touch /run/netns/<name>
mount --bind /proc/<PID>/ns/net /run/netns/<name>
ip netns exec <name> <command>