containers • Beginner

Linux Kernel Namespaces: The Illusion of a Private Machine

A container is just a standard Linux process isolated by 6 Kernel Namespaces: PID (Process IDs), NET (Network stacks/IPs), MNT (Mount points/RootFS), IPC (Inter-Process Comm), UTS (Hostname), and USER (UID/GID mapping).

Intuitive Mental Model

The Hotel Room vs Entire House: Virtual Machines build a completely separate house from the foundation up (Hypervisor + Guest OS). Containers give you a private hotel room with your own locked door, bathroom, and keycard (Namespaces) inside a shared building with shared plumbing (Host Linux Kernel).

Dockerfile / YAML Manifest / CLIProduction Standard

# Unshare system call to create isolated namespaces manually:
sudo unshare --fork --pid --mount-proc --net /bin/bash

# Inside isolated namespace:
ps aux
# PID 1 is your bash shell! The host's 300 other processes are invisible.

ip addr
# Clean isolated loopback interface without host network adapters.

Key Architectural Takeaways

•Containers do NOT have a guest kernel or virtualized BIOS; they share the host Linux kernel directly.
•PID Namespace maps Process ID 1 inside the container to a standard arbitrary PID (e.g. PID 48921) on the host.
•NET Namespace creates a private virtual network stack with its own IP, routing table, and iptables rules.

Common Production Mistake

Running processes as root inside containers without User Namespaces, allowing kernel exploit escapes with full root privileges on the host.