1 .\" Copyright (c) 2013 by Michael Kerrisk <mtk.manpages@gmail.com>
2 .\" and Copyright (c) 2012 by Eric W. Biederman <ebiederm@xmission.com>
4 .\" Permission is granted to make and distribute verbatim copies of this
5 .\" manual provided the copyright notice and this permission notice are
6 .\" preserved on all copies.
8 .\" Permission is granted to copy and distribute modified versions of this
9 .\" manual under the conditions for verbatim copying, provided that the
10 .\" entire resulting derived work is distributed under the terms of a
11 .\" permission notice identical to this one.
13 .\" Since the Linux kernel and libraries are constantly changing, this
14 .\" manual page may be incorrect or out-of-date. The author(s) assume no
15 .\" responsibility for errors or omissions, or for damages resulting from
16 .\" the use of the information contained herein. The author(s) may not
17 .\" have taken the same level of care in the production of this manual,
18 .\" which is licensed free of charge, as they might when working
21 .\" Formatted or processed versions of this manual, if unaccompanied by
22 .\" the source, must acknowledge the copyright and authors of this work.
25 .TH NAMESPACES 7 2013-01-14 "Linux" "Linux Programmer's Manual"
27 namespaces \- overview of Linux namespaces
29 A namespace wraps a global system resource in an abstraction that
30 makes it appear to the processes within the namespace that they
31 have their own isolated instance of the global resource.
32 Changes to the global resource are visible to other processes
33 that are members of the namespace, but are invisible to other processes.
34 One use of namespaces is to implement containers.
36 This page describes the various namespaces and the associated
38 files, and summarizes the APIs for working with namespaces.
40 .\" ==================== The namespaces API ====================
42 .SS The namespaces API
45 files described below,
46 the namespaces API includes the following system calls:
51 system call creates a new process.
54 argument of the call specifies one or more of the
56 flags listed below, then new namespaces are created for each flag,
57 and the child process is made a member of those namespaces.
58 (This system call also implements a number of features
59 unrelated to namespaces.)
64 system call allows the calling process to join an existing namespace.
65 The namespace to join is specified via a file descriptor that refers to
68 files described below.
73 system call moves the calling process to a new namespace.
76 argument of the call specifies one or more of the
78 flags listed below, then new namespaces are created for each flag,
79 and the calling process is made a member of those namespaces.
80 (This system call also implements a number of features
81 unrelated to namespaces.)
83 Creation of new namespaces using
87 in most cases requires the
90 User namespaces are the exception: since Linux 3.8,
91 no privilege is required to create a user namespace.
93 .\" ==================== The /proc/[pid]/ns/ directory ====================
95 .SS The /proc/[pid]/ns/ directory
98 .\" See commit 6b4e306aa3dc94a0545eb9279475b1ab6209a31f
99 subdirectory containing one entry for each namespace that
100 supports being manipulated by
105 $ \fBls -l /proc/$$/ns\fP
107 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 ipc -> ipc:[4026531839]
108 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 mnt -> mnt:[4026531840]
109 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 net -> net:[4026531956]
110 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 pid -> pid:[4026531836]
111 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 user -> user:[4026531837]
112 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 uts -> uts:[4026531838]
118 one of the files in this directory
119 to somewhere else in the file system keeps
120 the corresponding namespace of the process specified by
122 alive even if all processes currently in the namespace terminate.
124 Opening one of the files in this directory
125 (or a file that is bind mounted to one of these files)
126 returns a file handle for
127 the corresponding namespace of the process specified by
129 As long as this file descriptor remains open,
130 the namespace will remain alive,
131 even if all processes in the namespace terminate.
132 The file descriptor can be passed to
135 In Linux 3.7 and earlier, these files were visible as hard links.
136 Since Linux 3.8, they appear as symbolic links.
137 If two processes are in the same namespace, then the inode numbers of their
138 .IR /proc/[pid]/ns/xxx
139 symbolic links will be the same; an application can check this using the
143 The content of this symbolic link is a string containing
144 the namespace type and inode number as in the following example:
148 $ \fBreadlink /proc/$$/ns/uts\fP
153 The files in this subdirectory are as follows:
155 .IR /proc/[pid]/ns/ipc " (since Linux 3.0)"
156 This file is a handle for the IPC namespace of the process.
158 .IR /proc/[pid]/ns/mnt " (since Linux 3.8)"
159 This file is a handle for the mount namespace of the process.
161 .IR /proc/[pid]/ns/net " (since Linux 3.0)"
162 This file is a handle for the network namespace of the process.
164 .IR /proc/[pid]/ns/pid " (since Linux 3.8)"
165 This file is a handle for the PID namespace of the process.
167 .IR /proc/[pid]/ns/user " (since Linux 3.8)"
168 This file is a handle for the user namespace of the process.
170 .IR /proc/[pid]/ns/uts " (since Linux 3.0)"
171 This file is a handle for the IPC namespace of the process.
173 .\" ==================== IPC namespaces ====================
175 .SS IPC namespaces (CLONE_NEWIPC)
176 IPC namespaces isolate certain IPC resources,
177 namely, System V IPC objects (see
179 and (since Linux 2.6.30)
180 .\" commit 7eafd7c74c3f2e67c27621b987b28397110d643f
181 .\" https://lwn.net/Articles/312232/
182 POSIX message queues (see
184 The common characteristic of these IPC mechanisms is that IPC
185 objects are identified by mechanisms other than file system
188 Each IPC namespace has its own set of System V IPC identifiers and
189 its own POSIX message queue file system.
190 Objects created in an IPC namespace are visible to all other processes
191 that are members of that namespace,
192 but are not visible to processes in other IPC namespaces.
194 When an IPC namespace is destroyed
195 (i.e., when the last process that is a member of the namespace terminates),
196 all IPC objects in the namespace are automatically destroyed.
198 Use of IPC namespaces requires a kernel that is configured with the
202 .\" ==================== Network namespaces ====================
204 .SS Network namespaces (CLONE_NEWNET)
205 Network namespaces provide isolation of the system resources associated
206 with networking: network devices, IP addresses, IP routing tables,
210 directory, port numbers, and so on.
212 A network namespace provides an isolated view of the networking stack
213 (network device interfaces, IPv4 and IPv6 protocol stacks,
214 IP routing tables, firewall rules, the
218 directory trees, sockets, etc.).
219 A physical network device can live in exactly one
221 A virtual network device ("veth") pair provides a pipe-like abstraction
222 .\" FIXME Add pointer to veth(4) page when it is eventually completed
223 that can be used to create tunnels between network namespaces,
224 and can be used to create a bridge to a physical network device
225 in another namespace.
227 When a network namespace is freed
228 (i.e., when the last process in the namespace terminates),
229 its physical network devices are moved back to the
230 initial network namespace (not to the parent of the process).
232 Use of network namespaces requires a kernel that is configured with the
236 .\" ==================== Mount namespaces ====================
238 .SS Mount namespaces (CLONE_NEWNS)
239 Mount namespaces isolate the set of file system mount points,
240 meaning that processes in different mount namespaces can
241 have different views of the file system hierarchy.
242 The set of mounts in a mount namespace is modified using
248 .IR /proc/[pid]/mounts
249 file (present since Linux 2.4.19)
250 lists all the file systems currently mounted in the
251 process's mount namespace.
252 The format of this file is documented in
254 Since kernel version 2.6.15, this file is pollable:
255 after opening the file for reading, a change in this file
256 (i.e., a file system mount or unmount) causes
258 to mark the file descriptor as readable, and
262 mark the file as having an error condition.
265 .IR /proc/[pid]/mountstats
266 file (present since Linux 2.6.17)
267 exports information (statistics, configuration information)
268 about the mount points in the process's mount namespace.
269 This file is only readable by the owner of the process.
270 Lines in this file have the form:
275 device /dev/sda7 mounted on /home with fstype ext3 [statistics]
280 The fields in each line are:
283 The name of the mounted device
284 (or "nodevice" if there is no corresponding device).
287 The mount point within the file system tree.
290 The file system type.
293 Optional statistics and configuration information.
294 Currently (as at Linux 2.6.26), only NFS file systems export
295 information via this field.
298 .\" ==================== PID namespaces ====================
300 .SS PID namespaces (CLONE_NEWPID)
301 PID namespaces isolate the process ID number space,
302 meaning that processes in different PID namespaces can have the same PID.
303 PID namespaces allow containers to migrate to a new host
304 while the processes inside the container maintain the same PIDs.
306 PIDs in a new PID namespace start at 1,
307 somewhat like a standalone system, and calls to
312 will produce processes with PIDs that are unique within the namespace.
314 The first process created in a new namespace
315 (i.e., the process created using
319 flag, or the first child created by a process after a call to
323 flag) has the PID 1, and is the "init" process for the namespace (see
325 Children that are orphaned within the namespace will be reparented
326 to this process rather than
329 If the "init" process of a PID namespace terminates,
330 the kernel terminates all of the processes in the namespace via a
333 This behavior reflects the fact that the "init" process
334 is essential for the correct operation of a PID namespace.
335 In this case, a subsequent
337 into this PID namespace (e.g., from a process that has done a
339 into the namespace using an open file descriptor for a
340 .I /proc/[pid]/ns/pid
341 file corresponding to a process that was in the namespace)
342 will fail with the error
344 it is not possible to create a new processes in a PID namespace whose "init"
345 process has terminated.
347 Only signals for which the "init" process has established a signal handler
348 can be sent to the "init" process by other members of the PID namespace.
349 This restriction applies even to privileged processes,
350 and prevents other members of the PID namespace from
351 accidentally killing the "init" process.
353 Likewise, a process in an ancestor namespace
354 can\(emsubject to the usual permission checks described in
356 signals to the "init" process of a child PID namespace only
357 if the "init" process has established a handler for that signal.
358 (Within the handler, the
367 are treated exceptionally:
368 these signals are forcibly delivered when sent from an ancestor PID namespace.
369 Neither of these signals can be caught by the "init" process,
370 and so will result in the usual actions associated with those signals
371 (respectively, terminating and stopping the process).
373 PID namespaces can be nested.
374 When a new PID namespace is created,
375 the processes in that namespace are visible
376 in the PID namespace of the process that created the new namespace;
377 analogously, if the parent PID namespace is itself
378 the child of another PID namespace,
379 then processes in the child and parent PID namespaces will both be
380 visible in the grandparent PID namespace.
381 Conversely, the processes in the "child" PID namespace do not see
382 the processes in the parent namespace.
383 More succinctly: a process can see (e.g., send signals with
385 only processes contained in its own PID namespace
386 and the namespaces nested below that PID namespace.
388 A process will have one PID for each of the layers of the hierarchy
389 starting from the PID namespace in which it resides
390 through to the root PID namespace.
393 always returns the PID associated with the namespace in which
396 Some processes in a PID namespace may have parents
397 that are outside of the namespace.
398 For example, the parent of the initial process in the namespace
402 process with PID 1) is necessarily in another namespace.
403 Likewise, the direct children of a process that uses
405 to cause its children to join a PID namespace are in a different
406 PID namespace from the caller of
410 for such processes return 0.
412 After creating a new PID namespace,
413 it is useful for the child to change its root directory
414 and mount a new procfs instance at
416 so that tools such as
419 .\" mount -t proc proc /proc
422 is also included in the
428 then it isn't necessary to change the root directory:
429 a new procfs instance can be mounted directly over
434 that specify a PID namespace file descriptor
439 flag cause children subsequently created
440 by the caller to be placed in a different PID namespace from the caller.
441 These calls do not, however,
442 change the PID namespace of the calling process,
443 because doing so would change the caller's idea of its own PID
446 which would break many applications and libraries.
447 To put things another way:
448 a process's PID namespace membership is determined when the process is created
449 and cannot be changed thereafter.
451 Every thread in a process must be in the same PID namespace.
452 For this reason, the two following call sequences will fail:
456 unshare(CLONE_NEWPID);
457 clone(..., CLONE_VM, ...); /* Fails */
459 setns(fd, CLONE_NEWPID);
460 clone(..., CLONE_VM, ...); /* Fails */
468 calls only change the PID namespace for created children, the
470 calls necessarily put the new thread in a different PID namespace from
473 When a process ID is passed over a UNIX domain socket to a
474 process in a different PID namespace (see the description of
478 it is translated into the corresponding PID value in
479 the receiving process's PID namespace.
480 .\" FIXME Presumably, a similar thing happens with the UID and GID passed
481 .\" via a UNIX domain socket. That needs to be confirmed and documented
482 .\" under the "User namespaces" section.
484 Use of PID namespaces requires a kernel that is configured with the
488 .\" ==================== User namespaces ====================
490 .SS User namespaces (CLONE_NEWUSER)
491 User namespaces isolate security-related identifiers, in particular,
492 user IDs, group IDs, keys (see
495 A process's user and group IDs can be different
496 inside and outside a user namespace.
498 a process can have a normal unprivileged user ID outside a user namespace
499 while at the same time having a user ID of 0 inside the namespace;
501 the process has full privileges for operations inside the user namespace,
502 but is unprivileged for operations outside the namespace.
504 User namespaces can be nested;
505 that is, each user namespace has a parent user namespace,
506 and can have zero or more child user namespaces.
507 The parent of a user namespace is the user namespace
508 of the process that creates the user namespace via a call to
516 When a user namespace is created,
517 it starts out without a mapping of user IDs (group IDs)
518 to the parent user namespace.
519 The desired mapping of user IDs (group IDs) to the parent user namespace
520 may be set by writing into
521 .IR /proc/[pid]/uid_map
522 .RI ( /proc/[pid]/gid_map );
525 The first process in a user namespace starts out with a complete set
526 of capabilities with respect to the new user namespace.
528 System calls that return user IDs (group IDs) will return
529 either the user ID (group ID) mapped into the current
530 user namespace if there is a mapping, or the overflow user ID (group ID);
531 the default value for the overflow user ID (group ID) is 65534.
532 See the descriptions of
533 .IR /proc/sys/kernel/overflowuid
535 .IR /proc/sys/kernel/overflowgid
539 Starting in Linux 3.8, unprivileged processes can create user namespaces,
540 and mount, PID, IPC, network, and UTS namespaces can be created with just the
542 capability in the caller's user namespace.
546 is specified along with other
552 call, the user namespace is guaranteed to be created first,
553 giving the caller privileges over the remaining
554 namespaces created by the call.
555 Thus, it is possible for an unprivileged caller to specify this combination
558 The following rules apply with respect to the capabilities granted
560 .\" In the 3.8 sources, see security/commoncap.c::cap_capable():
562 If a process has a capability in a parent user namespace,
563 then it has that capability in all child (and further removed descendant)
566 .\" * The owner of the user namespace in the parent of the
567 .\" * user namespace has all caps.
568 When a user namespace is created, the kernel records the effective
569 user ID of the creating process as being the "owner" of the namespace,
570 and likewise associates the effective group ID of the creating process
572 A process whose effective user ID matches that of the
573 owner of a user namespace and which is a member of the parent namespace
574 (or a further removed namespace that is a direct ancestor)
575 has all capabilities in the user namespace.
576 .\" As a rough approximation, this means that
577 .\" the user who creates a user namespace
578 .\" has all capabilities inside that namespace and its descendants.
580 Use of user namespaces requires a kernel that is configured with the
584 Over the years, there have been a lot of features that have been added
585 to the Linux kernel that are only available to privileged users
586 because of their potential to confuse set-user-ID-root applications.
587 In general, it becomes safe to allow the root user in a user namespace to
588 use those features because it is impossible, while in a user namespace,
589 to gain more privilege than the root user of a user namespace has.
592 .IR /proc/[pid]/uid_map
594 .IR /proc/[pid]/gid_map
595 files (available since Linux 3.5)
596 .\" commit 22d917d80e842829d0ca0a561967d728eb1d6303
597 expose the mappings for user and group IDs
598 inside the user namespace for the process
600 The description here explains the details for
604 but each instance of "user ID" is replaced by "group ID".
608 file exposes the mapping of user IDs from the user namespace
611 to the user namespace of the process that opened
613 (but see a qualification to this point below).
614 In other words, processes that are in different user namespaces
615 will potentially see different values when reading from a particular
617 file, depending on the user ID mappings for the user namespaces
618 of the reading processes.
622 file specifies a 1-to-1 mapping of a range of contiguous
623 user IDs between two user namespaces.
624 (When a user namespace is first created, this file is empty.)
625 The specification in each line takes the form of
626 three numbers delimited by white space.
627 The first two numbers specify the starting user ID in
629 The third number specifies the length of the mapped range.
630 In detail, the fields are interpreted as follows:
632 The start of the range of user IDs in
633 the user namespace of the process
636 The start of the range of user
637 IDs to which the user IDs specified by field one map.
638 How field two is interpreted depends on whether the process that opened
642 are in the same user namespace, as follows:
645 If the two processes are in different user namespaces:
646 field two is the start of a range of
647 user IDs in the user namespace of the process that opened
650 If the two processes are in the same user namespace:
651 field two is the start of the range of
652 user IDs in the parent user namespace of the process
654 This case enables the opener of
656 (the common case here is opening
657 .IR /proc/self/uid_map )
658 to see the mapping of user IDs into the user namespace of the process
659 that created this user namespace.
662 The length of the range of user IDs that is mapped between the two
665 After the creation of a new user namespace, the
669 of the process in the namespace may be written to
671 to define the mapping of user IDs in the new user namespace.
672 (An attempt to write more than once to a
674 file in a user namespace fails with the error
679 must conform to the following rules:
681 The three fields must be valid numbers,
682 and the last field must be greater than 0.
684 Lines are terminated by newline characters.
686 There is an (arbitrary) limit on the number of lines in the file.
687 As at Linux 3.8, the limit is five lines.
688 In addition, the number of bytes written to
689 the file must be less than the system page size,
690 .\" FIXME(Eric): the restriction "less than" rather than "less than or equal"
691 .\" seems strangely arbitrary. Furthermore, the comment does not agree
692 .\" with the code in kernel/user_namespace.c. Which is correct.
693 and the write must be performed at the start of the file (i.e.,
697 can't be used to write to nonzero offsets in the file).
699 The range of user IDs specified in each line cannot overlap with the ranges
701 In the current implementation (Linux 3.8), this requirement is
702 satisfied by a simplistic implementation that imposes the further
704 the values in both field 1 and field 2 of successive lines must be
705 in ascending numerical order.
707 At least one line must be written to the file.
709 Writes that violate the above rules fail with the error
712 In order for a process to write to the
713 .I /proc/[pid]/uid_map
714 .RI ( /proc/[pid]/gid_map )
715 file, all of the following requirements must be met:
717 The writing process must have the
720 capability in the user namespace of the process
723 .\" Something isn't quite right in the description here.
724 .\" Suppose UID 1000 creates a user namespace. At this point, UID 0 in
725 .\" the parent namespace can write a map of (say) '0 1000 10' to uid_map.
726 .\" That succeeds. But how is that case covered in the three rules here?
727 .\" In other words, how does UID 0 in the parent namespace have any
728 .\" capabilities in the new child namespace? Somewhere on the page,
729 .\" I think there needs to be a statement about the privileges of
730 .\" UID 0 when no mapping has yet been defined, right?
731 .\" Or is it simply the case that UID 0 in the parent namespace
732 .\" always has all capabilities in the child namespace?
735 The writing process must be in either the user namespace of the process
737 or inside the parent user namespace of the process
740 One of the following is true:
746 consists of a single line that maps the writing process's file system user ID
747 (group ID) in the parent user namespace to a user ID (group ID)
748 in the user namespace.
749 The usual case here is that this single line provides a mapping for user ID
750 of the process that created the namespace.
755 capability in the parent user namespace.
756 Thus, a privileged process can make mappings to arbitrary user IDs (group IDs)
757 in the parent user namespace.
760 Writes that violate the above rules fail with the error
763 When a process inside a user namespace executes
764 a set-user-ID (set-group-ID) program,
765 the process's effective user (group) ID inside the namespace is changed
766 to whatever value is mapped for the user (group) ID of the file.
767 However, if either the user
769 the group ID of the file has no mapping inside the namespace,
770 the set-user-ID (set-group-ID) bit is silently ignored:
771 the new program is executed,
772 but the process's effective user (group) ID is left unchanged.
773 (This mirrors the semantics of executing a set-user-ID or set-group-ID
774 program that resides on a file system that was mounted with the
779 .\" ==================== UTS namespaces ====================
781 .SS UTS namespaces (CLONE_NEWUTS)
782 UTS namespaces provide isolation of two system identifiers:
783 the hostname and the NIS domain name.
784 These identifiers are set using
787 .BR setdomainname (2),
788 and can be retrieved using
792 .BR getdomainname (2).
794 Use of UTS namespaces requires a kernel that is configured with the
798 Namespaces are a Linux-specific feature.
808 .BR capabilities (7),