Linux namespaces
kernel-featureopen sourceThe kernel feature that gives a process a private view of a global resource, mounts, PIDs, network, users, the building block of containers.
documentedman7: namespaces(7) ↗
Namespaces virtualize a kernel resource so a set of processes sees its own instance: mount, PID, network, UTS, IPC, user, cgroup, and time namespaces. A mount namespace gives a private filesystem view; a user namespace maps UIDs so an unprivileged user can be root inside without being root outside, which is how tools like bubblewrap sandbox unprivileged. Namespaces are one of the two pillars (with cgroups) under every container runtime, but they share the host kernel.
Strengths
- Private per-process view of mounts, PIDs, network, and users
- User namespaces enable unprivileged isolation without root
- Near-zero overhead, the foundation of all container runtimes
Limitations
- Isolation of visibility, not a security boundary on its own
- Shared kernel, a kernel LPE escapes every namespace
- User-namespace misconfig has itself been a source of privilege-escalation CVEs