Containers unplugged: Linux namespaces
summary
Walks through concrete namespace effects and commands: shows the /proc//ns inode identifiers, uses unshare + mount /proc demo to prove PID namespaces need a new proc mount, explains mount namespaces let each container rearrange its visible filesystems, and lists seven namespace types (mount, UTS, network, PID, IPC, cgroup, user). Explains PID namespace hierarchy and max nesting 32, shows how UID 0 inside user namespace* enables unprivileged containers, and cites the ~570-line container C example as proof this is small, kernel-level isolation.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:22User Namespaces
- 5:02Mount Namespaces
- 22:19Lightweight Virtualization
- 25:08Isolation Using Namespaces
- 27:05Parent Mount
- 32:25Shared Sub Trees
- 32:50Ipc Namespaces
- 34:47Network Namespaces
- 35:48Things Can You Do with Network Namespaces
- 36:49Use Cases for Network Namespaces
related talks
01h 03mLinux Namespaces for Fun and Isolation
54mUnderstanding user namespaces
57mNamespaces for Security
47mLinux user namespaces: a blessing and a curse
32mLinux user namespaces: a blessing and a curse
39mLinux User Namespaces: A Blessing and a Curse
37mDocker without docker- understanding the basics
42mWhat's New in the User Namespace