Linux Namespaces for Fun and Isolation
summary
Machine examples use unshare with CLONE_NEWUSER and show writing /proc/self/uid_map and /proc/self/gid_map (and echoing "deny" to /proc/self/setgroups) so an unprivileged process can only map itself; code omits error checks. A new mount namespace is created, tempfs mounted and pivot_root over chroot swaps in a fresh root; PID namespaces require fork so the child becomes PID 1 and /proc shows only that process. IPC, cgroup remounts and a veth pair moved into a netns demonstrate isolated message queues, a private cgroup tree, and pingable virtual networking.
AI-written summary · about
chapters (12)
- 0:00Linux namespaces intro
- 1:11What namespaces are
- 3:17User namespace isolation
- 11:16Mount namespace isolation
- 15:11Custom root filesystem
- 20:41PID namespace isolation
- 28:07UTS namespace isolation
- 30:35Time namespace tricks
- 35:56IPC namespace isolation
- 40:47Cgroup namespace isolation
- 47:38Network namespace isolation
- 56:06Security & Q&A
related talks
54mContainers unplugged: Linux namespaces
57mNamespaces for Security
54mUnderstanding user namespaces
47mLinux user namespaces: a blessing and a curse
54mContainers unplugged: understanding user namespaces
42mWhat's New in the User Namespace
32mLinux user namespaces: a blessing and a curse
39mLinux User Namespaces: A Blessing and a Curse