Linux namespaces#

How a normal system works#

On a normal Linux system, every process shares the same resources. There is one filesystem, one list of processes, and one network stack. When you run ls /, you see the same files every other program sees. When you run ps, you see every process on the machine. When a web server opens port 80, no other program can open port 80, because there is only one set of ports and it’s already taken.

This is how most people expect a computer to work. Everything is running on the same machine, so everything sees the same machine.

What is a namespace#

A namespace is a Linux kernel feature that gives processes their own separate instance of one of those resources. A process in its own mount namespace has its own filesystem. A process in its own PID namespace sees only its own processes. A process in its own network namespace has its own interfaces, routes, and ports, so it can open port 80 even if another process on the same machine already has it.

Namespaces are a form of OS-level virtualization. A hypervisor virtualizes hardware so it can run separate operating systems. Namespaces work one level up. The kernel splits its own resources.

See your own namespaces#

Use the lsns command to see which namespaces your current shell is in.

user@host:~$ lsns -p $$
        NS TYPE   NPROCS   PID USER COMMAND
4026531832 mnt         3  2413 user -bash
4026531833 net         3  2413 user -bash
4026531834 time        3  2413 user -bash
4026531835 cgroup      3  2413 user -bash
4026531836 pid         3  2413 user -bash
4026531837 user        3  2413 user -bash
4026531838 uts         3  2413 user -bash
4026531839 ipc         3  2413 user -bash
  • lsns: Lists namespaces.
  • -p: Shows the namespaces of one process.
  • $$: The process ID of your current shell.

Each line shows the namespace’s ID number, its type, and how many processes are in it.

What is a network namespace#

A network namespace is a separate instance of the Linux networking stack. Each namespace has its own interfaces, addresses, routes, neighbor table, firewall rules, and sockets. A new namespace starts nearly empty, with only a loopback interface that is down.

Create a network namespace#

Create a network namespace called demo.

user@host:~$ sudo ip netns add demo
  • ip netns: Tells the ip tool you’re working with network namespaces.
  • add demo: Creates a new namespace named demo.

Look inside the namespace#

List the interfaces in the demo network namespace.

user@host:~$ sudo ip netns exec demo ip addr
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  • ip netns exec: Run a command inside a network namespace.
  • demo: The namespace to run the command in.
  • ip addr: The command to run. This is the same ip addr you use on the host, but here it only sees the interfaces inside demo.

Connecting your namespace#

Now that you can spin up an isolated network namespace, how do you actually let it talk back to the host or out to the internet? In the next section, we’ll wire up a veth pair, a virtual network cable, and attach it to a software bridge.

Backward Understanding VirtualBox Internal Network Adapters