Skip to main content

Linux Namespaces

Linux namespaces are a kernel feature that provide process isolation by giving each namespace its own view of system resources. First introduced in the early 2000s, namespaces became a cornerstone of modern containerization. By partitioning resources such as process IDs, filesystems, and network stacks, they allow multiple workloads to share the same host kernel while behaving as though they run on separate machines.

When combined with control groups (cgroups), namespaces form the foundation of technologies like Docker, Kubernetes, and LXC, enabling lightweight virtualization without the overhead of full virtual machines.

Types of Namespaces​

1. Mount Namespace (mnt)​

  • Purpose: Isolates filesystem mount points.

  • Effect: Each namespace can have its own view of the filesystem hierarchy. Mounting or unmounting in one namespace doesn’t affect others.

  • Example Use Case:

    • Containers have their own root filesystem mounted independently from the host.
    • Testing alternate filesystem structures without changing the host.

2. Process Namespace (pid)​

  • Purpose: Isolates process IDs (PIDs).

  • Effect: Processes in a namespace see only the processes inside it. PIDs may overlap between namespaces.

  • Example Use Case:

    • Containers appear to have their own init process and process tree.
    • Improved isolation for monitoring tools, as each namespace tracks only its own processes.

3. Network Namespace (net)​

  • Purpose: Isolates networking resources.

  • Effect: Each namespace has its own interfaces, routing tables, firewall rules, and sockets.

  • Example Use Case:

    • Containers get unique IP addresses and network stacks.
    • Network simulation and testing without extra hardware.

Walkthrough Example: Two Connected Namespaces

# Create namespaces
sudo ip netns add ns1
sudo ip netns add ns2

# Create a veth pair
sudo ip link add veth1 type veth peer name veth2

# Assign ends to namespaces
sudo ip link set veth1 netns ns1
sudo ip link set veth2 netns ns2

# Assign IPs
sudo ip netns exec ns1 ip addr add 10.0.0.1/24 dev veth1
sudo ip netns exec ns2 ip addr add 10.0.0.2/24 dev veth2

# Bring interfaces up
sudo ip netns exec ns1 ip link set veth1 up
sudo ip netns exec ns1 ip link set lo up
sudo ip netns exec ns2 ip link set veth2 up
sudo ip netns exec ns2 ip link set lo up

# Test connectivity
sudo ip netns exec ns1 ping -c 3 10.0.0.2

This setup makes ns1 and ns2 behave like separate hosts linked by a cable, all on the same system.

4. Interprocess Communication Namespace (ipc)​

  • Purpose: Isolates System V IPC objects and POSIX message queues.

  • Effect: Shared memory segments, semaphores, and message queues exist only within the namespace.

  • Example Use Case:

    • Prevents unintended communication between processes in different containers.
    • Enables safer multi-tenant environments.

5. UTS Namespace (uts)​

  • Purpose: Isolates system identifiers like hostname and NIS domain name.

  • Effect: Each namespace can set its own hostname.

  • Example Use Case:

    • Containers appear to have independent hostnames.
    • Useful for simulating multiple servers in one machine.

6. User Namespace (user)​

  • Purpose: Isolates user and group IDs.

  • Effect: A process may appear as root inside the namespace but map to an unprivileged user on the host.

  • Example Use Case:

    • Rootless containers (e.g., Podman) for improved security.
    • Developers testing privileged operations without risking the host.

7. Cgroup Namespace (cgroup)​

  • Purpose: Isolates visibility of control groups.

  • Effect: A process sees only the cgroups in its namespace.

  • Example Use Case:

    • Containers monitor only their own CPU/memory limits.
    • Prevents one container from interfering with another’s resource metrics.

8. Time Namespace (time)​

  • Purpose: Isolates system clocks.

  • Effect: Each namespace can have its own view of CLOCK_MONOTONIC and CLOCK_BOOTTIME.

  • Example Use Case:

    • Simulating uptime-dependent software without altering host time.
    • Running legacy applications expecting certain boot times.

Relation to Containerization​

Containers combine several namespaces at once:

  • mnt → private filesystem
  • pid → isolated process tree
  • net → virtual network stack
  • uts → unique hostname
  • ipc → isolated shared memory
  • user → privilege remapping
  • cgroup → resource visibility

This lightweight isolation is what makes containers efficient compared to traditional virtual machines.

Conclusion​

Linux namespaces provide fine-grained isolation of system resources. From filesystems and processes to networking and clocks, namespaces enable workloads to run securely and independently while still sharing a single kernel. Combined with cgroups, they form the backbone of container platforms like Docker and Kubernetes, powering much of today’s cloud-native infrastructure.

Understanding namespaces not only demystifies containers but also gives system engineers powerful tools for testing, isolation, and security.