Linux namespaces

Why namespaces exist

Containers are not virtual machines. They share one kernel with the host. Isolation comes from two mechanisms working together:

• cgroups limit how much resource a process may use
• namespaces limit what a process can see

The seven types

How they get created

Three ways:

1. clone() / unshare() syscall: a program asks the kernel for a new namespace
2. ip netns add NAME: creates a network namespace and mounts /run/netns/NAME so you can refer to it later (see veth-pair)
3. unshare CMD: a wrapper that does unshare() plus exec()

What you see in /proc/<pid>/ns/

Each process is a set of namespace handles under /proc/<pid>/ns/:

ls -l /proc/self/ns/

# net   -> 'net:[4026531992]'

# mnt   -> 'mnt:[4026531840]'

# pid   -> 'pid:[4026531836]'

# ...

The number in brackets is the inode id of the namespace. If two processes have the same id for net, they are in the same network namespace. This is the first way to diagnose which namespace you are in.

To enter the existing namespace of another process, use nsenter:

sudo nsenter -t <pid> -n -p ip addr   # run ip addr in the net+pid ns of process <pid>

Connection to Docker

When you run docker run image, Docker:

1. calls unshare() with every flag except time
2. creates a veth-pair, leaves one end on the host in a bridge, and puts the other end in the new net namespace
3. mounts an overlay filesystem as the process root
4. places the process in cgroups for limits
5. runs exec on the binary from the image

That is all. There is no VM and no hypervisor here. The isolation comes from namespaces plus cgroups.