Linux Namespaces
The kernel feature that gives a process its own private view of a global resource — the foundation containers are built from.
Linux namespaces partition a kernel resource so that a process sees its own private instance of it instead of the one true global copy. There are separate namespace types for process IDs, network interfaces, mount points, hostnames, user/group IDs, and inter-process communication objects, and a process can be placed in any combination of them independently.
A PID namespace is the clearest example: inside it, the first process a container starts is PID 1, able to see only itself and its own descendants, while the host still sees that same process under its real, much larger PID. A mount namespace gives a process its own filesystem tree, so mounting something inside it never affects anything outside. Combine a handful of namespace types and you get the isolation illusion that containers run on — a process that believes it has the whole machine to itself.
Namespaces isolate what a process can see; they say nothing about what it can use. A namespaced process can still consume unlimited CPU or memory unless something else constrains it — that's the job of Control Groups, the companion kernel feature that containers combine with namespaces to get both isolation and resource limits.
Namespaces are also not a security boundary on their own. The kernel underneath is shared, and a bug in a syscall a namespaced process can still reach is a path out of the container — the reason container runtimes layer seccomp filters and capability drops on top rather than trusting namespaces alone.
See also8
Chroot
Rebasing a process's idea of the filesystem root, the oldest and shallowest form of Unix process isolation.
Systems & Tooling8 connections
Process
A running program with its own memory, environment, and identity.
Systems & Tooling33 connections
Least Privilege
Granting only the permissions actually required, so a compromise has a small ceiling.
Systems & Tooling38 connections
Loopback
The network address a computer uses to talk to itself, where packets go out and come straight back without touching any hardware, the home of development servers and a recurring blind spot in security.
Networks & Distribution12 connections
Agent Sandbox
Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.
Agents & Language Models14 connections
Kubernetes
A system that runs containers across a cluster of machines by continually reconciling what is running with a declared desired state, powerful and notoriously complex.
Systems & Tooling10 connections
Superuser
The all-powerful root account on Unix systems, how sudo hands out its power temporarily, and why both attackers and good security design revolve around who gets it.
Systems & Tooling10 connections
Time-of-Check to Time-of-Use
A race where a program checks a condition and then acts on it, but the world changes in between, the root of classic file-permission exploits and of double-spending bugs in web applications.
Systems & Tooling12 connections
Linked from10
- Agent SandboxAgents & Language Models
Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.
- ChrootSystems & Tooling
Rebasing a process's idea of the filesystem root, the oldest and shallowest form of Unix process isolation.
- Control GroupsSystems & Tooling
The Linux kernel feature that caps and accounts for a process group's CPU, memory, and I/O — the resource-limiting half of a container.
- HypervisorSystems & Tooling
The layer that lets multiple guest operating systems share one machine's hardware, each believing it owns the machine.
- KernelSystems & Tooling
The core of an operating system that runs with full hardware privileges, managing processes, memory, devices, and files on behalf of every other program.
- KubernetesSystems & Tooling
A system that runs containers across a cluster of machines by continually reconciling what is running with a declared desired state, powerful and notoriously complex.
- LoopbackNetworks & Distribution
The network address a computer uses to talk to itself, where packets go out and come straight back without touching any hardware, the home of development servers and a recurring blind spot in security.
- SuperuserSystems & Tooling
The all-powerful root account on Unix systems, how sudo hands out its power temporarily, and why both attackers and good security design revolve around who gets it.
- System CallSystems & Tooling
The doorway through which a program asks the operating system kernel to do anything privileged, from reading a file to starting a process.
- Time-of-Check to Time-of-UseSystems & Tooling
A race where a program checks a condition and then acts on it, but the world changes in between, the root of classic file-permission exploits and of double-spending bugs in web applications.