Linux Beyond the Basics: Namespaces

Virtual Reality for Processes

4 min readJun 4, 2024

This blog post is part of the series Linux Beyond the Basics.

Introduction

Linux is renowned for its power and flexibility, and a key part of this is the concept of namespaces. If you’ve ever wondered how containers work or want to take your Linux skills to the next level, understanding namespaces is essential.

What are Namespaces?

Think of namespaces as virtual environments within your Linux system. They create isolated instances of global system resources, allowing processes to have their own view of things like filesystems, process IDs, network interfaces, and more. This isolation is crucial for security, stability, and managing complex applications.

Why Use Namespaces?

Security: By isolating processes into different namespaces, you limit the damage a compromised application can do. A malicious process can’t mess with the files or network of another process in a different namespace.
Resource Management: Namespaces enable you to control and allocate resources effectively. You can restrict a process to a specific portion of the filesystem or network, preventing it from hogging resources needed by other processes.
Testing and Development: Namespaces provide safe sandboxes for experimenting with software configurations or testing new applications without affecting your main system.
Containers: Containers wouldn’t be possible without namespaces. They rely heavily on namespaces to create isolated environments where applications run as if they have their own dedicated system.

Types of Linux Namespaces

Mount (mnt): This namespace controls the mount points a process sees. You can have different processes mounted to different parts of the filesystem or even create entirely separate filesystem trees for each namespace. This allows containers to have their own independent filesystems without affecting the host system.
Process ID (pid): In a pid namespace, processes have their own set of process IDs. The first process in a pid namespace (PID 1) becomes the “init” process for that namespace. This isolation prevents processes from interfering with each other’s signals and resource management. This is essential for containers, as each container has its own PID 1.
Network (net): Network namespaces give processes their own network stack, including network interfaces, IP addresses, routing tables, and firewall rules. This is fundamental for container networking, allowing each container to have its own IP address and network configuration. You can also use network namespaces for complex network setups like VPNs.
Interprocess Communication (ipc): This namespace isolates System V IPC resources like message queues and semaphores, preventing processes in different namespaces from accessing each other’s IPC resources. This adds an extra layer of security and prevents conflicts between processes.
Unix Timesharing System (uts): The UTS namespace lets you set different hostnames and domain names for each namespace, useful for container environments where you want containers to have distinct identities. This helps with network management and identification of different containers.
User: In a user namespace, processes have their own user and group IDs. A process that’s unprivileged in the parent namespace can be mapped to a privileged user (like root) within its own user namespace. This allows for greater security and flexibility in managing user permissions within containers.
Time: Introduced in Linux 5.6, the time namespace allows processes to have their own view of the system clock (both CLOCK_MONOTONIC and CLOCK_BOOTTIME). This is used for tasks like adjusting container time independently or simulating time shifts for testing. For example, you could speed up or slow down time within a container for debugging or testing purposes.
Cgroup: Although not strictly a namespace, cgroups are often used in conjunction with namespaces. They provide resource limiting and accounting for groups of processes. This allows you to control how much CPU, memory, disk I/O, and other resources a group of processes can use. This is crucial for preventing resource exhaustion and ensuring fairness in resource allocation.

Inspecting the Namespaces of a Process

You have several ways to check the namespaces a Linux process belongs to:

1. The /proc/<PID>/ns Directory:

The /proc filesystem provides a wealth of information about running processes. Within the /proc/<PID>/ns directory (replace <PID> with the process ID), you'll find symbolic links to the namespace files for each type of namespace the process belongs to:

ls -l /proc/<PID>/ns

Each symbolic link has the format <type> -> '<type>:[<inode>]. <type> indicates the namespace type (e.g., cgroup, ipc, mnt, net, pid, user), and <inode> is the unique identifier for that namespace.

2. The lsns Command:

The lsns command is specifically designed to list namespaces:

lsns -p <PID>

This will list all the namespaces the process with the given PID is a member of.

3. For Network Namespaces:

You can use the ip netns command to identify the network namespace of a process:

ip netns identify <PID>

This will either display the name of the network namespace if it’s a named namespace or the inode number if it’s an anonymous namespace.

Example:

Let’s say you want to check the namespaces of a process named “firefox”:

# Using /proc:
ls -l /proc/<firefox_PID>/ns

Conclusion

Linux namespaces are a cornerstone of modern system administration and containerization. By mastering namespaces, you unlock a deeper level of control over your Linux systems, enhancing security, isolation, and resource management. While they may seem complex at first, the benefits they offer are undeniable. Whether you’re managing containers, setting up virtual environments, or simply looking to expand your Linux knowledge, delving into namespaces is a worthwhile endeavor.