Linux namespaces are the core technology enabling container isolation. Understanding them deeply is essential for infrastructure engineers working with Docker, Kubernetes, and any container-based systems.
Interview Frequency: Very High (especially at infrastructure companies) Key Topics: Namespace types, creation mechanisms, container implementation Time to Master: 12-14 hours
# Create new PID namespacesudo unshare --pid --fork --mount-proc bash# Inside new namespace:ps aux # Only shows processes in this namespaceecho $$ # PID is 1!# View from host:# The bash process has a different PID in host namespace
# Create network namespacesudo ip netns add container1# List network namespacesip netns list# Execute command in namespacesudo ip netns exec container1 ip addr# Create veth pairsudo ip link add veth-host type veth peer name veth-container# Move one end to container namespacesudo ip link set veth-container netns container1# Configure interfacessudo ip addr add 10.0.0.1/24 dev veth-hostsudo ip link set veth-host upsudo ip netns exec container1 ip addr add 10.0.0.2/24 dev veth-containersudo ip netns exec container1 ip link set veth-container upsudo ip netns exec container1 ip link set lo up# Test connectivitysudo ip netns exec container1 ping 10.0.0.1# Enable NAT for internet accesssudo iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADEsudo ip netns exec container1 ip route add default via 10.0.0.1
# Create container-like filesystem isolationsudo unshare --mount --fork bash# Make mounts private (don't leak to host)mount --make-rprivate /# Create new rootmkdir -p /tmp/newroot/{bin,lib,lib64,proc,sys,dev}# Copy busybox for a minimal rootcp /bin/busybox /tmp/newroot/bin/# Mount special filesystemsmount -t proc proc /tmp/newroot/procmount -t sysfs sys /tmp/newroot/sys# Change rootcd /tmp/newrootpivot_root . .umount -l .# Now we're in new root/bin/busybox sh
# Run rootless container with Podmanpodman run -it --rm alpine sh# Inside container: appears as rootid # uid=0(root)# On host: process runs as your userps aux | grep alpine # Shows your username, not root
# View namespace of a processls -la /proc/$$/ns/# lrwxrwxrwx 1 user user 0 Nov 29 10:00 cgroup -> 'cgroup:[4026531835]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 ipc -> 'ipc:[4026531839]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 mnt -> 'mnt:[4026531840]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 net -> 'net:[4026531992]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 pid -> 'pid:[4026531836]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 user -> 'user:[4026531837]'# lrwxrwxrwx 1 user user 0 Nov 29 10:00 uts -> 'uts:[4026531838]'# Compare namespacesreadlink /proc/$$/ns/netreadlink /proc/1/ns/net # Different if in different namespace# Enter namespacensenter --target 1234 --net --pid bash
# Create nested PID namespacessudo unshare --pid --fork bash -c ' echo "Level 1 PID: $$" unshare --pid --fork bash -c " echo \"Level 2 PID: \$$\" ps aux sleep infinity " & ps aux wait'# View from hostps aux | grep sleep# Shows actual PID (not 1)# Check namespace relationshipsudo ls -la /proc/<outer-pid>/ns/sudo ls -la /proc/<inner-pid>/ns/
Lab 2: Network Namespace Networking
Objective: Build container networking from scratch
Copy
# Create two "containers" that can communicate# Create namespacessudo ip netns add container1sudo ip netns add container2# Create bridgesudo ip link add br0 type bridgesudo ip addr add 10.0.0.1/24 dev br0sudo ip link set br0 up# Create veth pairssudo ip link add veth1 type veth peer name veth1-brsudo ip link add veth2 type veth peer name veth2-br# Move to namespacessudo ip link set veth1 netns container1sudo ip link set veth2 netns container2# Connect to bridgesudo ip link set veth1-br master br0sudo ip link set veth2-br master br0sudo ip link set veth1-br upsudo ip link set veth2-br up# Configure container1sudo ip netns exec container1 ip addr add 10.0.0.2/24 dev veth1sudo ip netns exec container1 ip link set veth1 upsudo ip netns exec container1 ip link set lo up# Configure container2sudo ip netns exec container2 ip addr add 10.0.0.3/24 dev veth2sudo ip netns exec container2 ip link set veth2 upsudo ip netns exec container2 ip link set lo up# Test connectivitysudo ip netns exec container1 ping -c 3 10.0.0.3# Cleanupsudo ip netns del container1sudo ip netns del container2sudo ip link del br0
Lab 3: Build a Minimal Container
Objective: Create container-like isolation
Copy
#!/bin/bash# mini-container.shset -eROOTFS="/tmp/container-root"CONTAINER_NAME="mini-container"# Create rootfs using debootstrap or busyboxmkdir -p $ROOTFSif ! [ -f "$ROOTFS/bin/sh" ]; then # Use busybox for minimal root mkdir -p $ROOTFS/{bin,proc,sys,dev,tmp} cp /bin/busybox $ROOTFS/bin/ for cmd in sh ls ps cat echo mount; do ln -sf busybox $ROOTFS/bin/$cmd donefi# Run containersudo unshare \ --mount \ --uts \ --ipc \ --pid \ --fork \ /bin/bash -c " # Set hostname hostname $CONTAINER_NAME # Mount proc and sys mount -t proc proc $ROOTFS/proc mount -t sysfs sys $ROOTFS/sys # Change root cd $ROOTFS mkdir -p .oldroot pivot_root . .oldroot # Unmount old root umount -l /.oldroot rmdir /.oldroot # Run shell exec /bin/sh "
