1 .\" Copyright (c) 2013 by Michael Kerrisk <mtk.manpages@gmail.com>
2 .\" and Copyright (c) 2012 by Eric W. Biederman <ebiederm@xmission.com>
4 .\" %%%LICENSE_START(VERBATIM)
5 .\" Permission is granted to make and distribute verbatim copies of this
6 .\" manual provided the copyright notice and this permission notice are
7 .\" preserved on all copies.
9 .\" Permission is granted to copy and distribute modified versions of this
10 .\" manual under the conditions for verbatim copying, provided that the
11 .\" entire resulting derived work is distributed under the terms of a
12 .\" permission notice identical to this one.
14 .\" Since the Linux kernel and libraries are constantly changing, this
15 .\" manual page may be incorrect or out-of-date. The author(s) assume no
16 .\" responsibility for errors or omissions, or for damages resulting from
17 .\" the use of the information contained herein. The author(s) may not
18 .\" have taken the same level of care in the production of this manual,
19 .\" which is licensed free of charge, as they might when working
22 .\" Formatted or processed versions of this manual, if unaccompanied by
23 .\" the source, must acknowledge the copyright and authors of this work.
27 .TH PID_NAMESPACES 7 2016-07-17 "Linux" "Linux Programmer's Manual"
29 pid_namespaces \- overview of Linux PID namespaces
31 For an overview of namespaces, see
34 PID namespaces isolate the process ID number space,
35 meaning that processes in different PID namespaces can have the same PID.
36 PID namespaces allow containers to provide functionality
37 such as suspending/resuming the set of processes in the container and
38 migrating the container to a new host
39 while the processes inside the container maintain the same PIDs.
41 PIDs in a new PID namespace start at 1,
42 somewhat like a standalone system, and calls to
47 will produce processes with PIDs that are unique within the namespace.
49 Use of PID namespaces requires a kernel that is configured with the
53 .\" ============================================================
55 .SS The namespace "init" process
56 The first process created in a new namespace
57 (i.e., the process created using
61 flag, or the first child created by a process after a call to
65 flag) has the PID 1, and is the "init" process for the namespace (see
67 A child process that is orphaned within the namespace will be reparented
68 to this process rather than
70 (unless one of the ancestors of the child
71 in the same PID namespace employed the
73 .B PR_SET_CHILD_SUBREAPER
74 command to mark itself as the reaper of orphaned descendant processes).
76 If the "init" process of a PID namespace terminates,
77 the kernel terminates all of the processes in the namespace via a
80 This behavior reflects the fact that the "init" process
81 is essential for the correct operation of a PID namespace.
82 In this case, a subsequent
84 into this PID namespace will fail with the error
86 it is not possible to create a new processes in a PID namespace whose "init"
87 process has terminated.
88 Such scenarios can occur when, for example,
89 a process uses an open file descriptor for a
91 file corresponding to a process that was in a namespace to
93 into that namespace after the "init" process has terminated.
94 Another possible scenario can occur after a call to
96 if the first child subsequently created by a
98 terminates, then subsequent calls to
103 Only signals for which the "init" process has established a signal handler
104 can be sent to the "init" process by other members of the PID namespace.
105 This restriction applies even to privileged processes,
106 and prevents other members of the PID namespace from
107 accidentally killing the "init" process.
109 Likewise, a process in an ancestor namespace
110 can\(emsubject to the usual permission checks described in
112 signals to the "init" process of a child PID namespace only
113 if the "init" process has established a handler for that signal.
114 (Within the handler, the
123 are treated exceptionally:
124 these signals are forcibly delivered when sent from an ancestor PID namespace.
125 Neither of these signals can be caught by the "init" process,
126 and so will result in the usual actions associated with those signals
127 (respectively, terminating and stopping the process).
129 Starting with Linux 3.4, the
131 system call causes a signal to be sent to the namespace "init" process.
136 .\" ============================================================
138 .SS Nesting PID namespaces
139 PID namespaces can be nested:
140 each PID namespace has a parent,
141 except for the initial ("root") PID namespace.
142 The parent of a PID namespace is the PID namespace of the process that
143 created the namespace using
147 PID namespaces thus form a tree,
148 with all namespaces ultimately tracing their ancestry to the root namespace.
150 A process is visible to other processes in its PID namespace,
151 and to the processes in each direct ancestor PID namespace
152 going back to the root PID namespace.
153 In this context, "visible" means that one process
154 can be the target of operations by another process using
155 system calls that specify a process ID.
156 Conversely, the processes in a child PID namespace can't see
157 processes in the parent and further removed ancestor namespaces.
158 More succinctly: a process can see (e.g., send signals with
162 etc.) only processes contained in its own PID namespace
163 and in descendants of that namespace.
165 A process has one process ID in each of the layers of the PID
166 namespace hierarchy in which is visible,
167 and walking back though each direct ancestor namespace
168 through to the root PID namespace.
169 System calls that operate on process IDs always
170 operate using the process ID that is visible in the
171 PID namespace of the caller.
174 always returns the PID associated with the namespace in which
175 the process was created.
177 Some processes in a PID namespace may have parents
178 that are outside of the namespace.
179 For example, the parent of the initial process in the namespace
182 process with PID 1) is necessarily in another namespace.
183 Likewise, the direct children of a process that uses
185 to cause its children to join a PID namespace are in a different
186 PID namespace from the caller of
190 for such processes return 0.
192 While processes may freely descend into child PID namespaces
197 they may not move in the other direction.
198 That is to say, processes may not enter any ancestor namespaces
199 (parent, grandparent, etc.).
200 Changing PID namespaces is a one-way operation.
205 operation can be used to discover the parental relationship
206 between PID namespaces; see
209 .\" ============================================================
211 .SS setns(2) and unshare(2) semantics
214 that specify a PID namespace file descriptor
219 flag cause children subsequently created
220 by the caller to be placed in a different PID namespace from the caller.
221 These calls do not, however,
222 change the PID namespace of the calling process,
223 because doing so would change the caller's idea of its own PID
226 which would break many applications and libraries.
228 To put things another way:
229 a process's PID namespace membership is determined when the process is created
230 and cannot be changed thereafter.
231 Among other things, this means that the parental relationship
232 between processes mirrors the parental relationship between PID namespaces:
233 the parent of a process is either in the same namespace
234 or resides in the immediate parent PID namespace.
235 .SS Compatibility of CLONE_NEWPID with other CLONE_* flags
237 can't be combined with some other
242 requires being in the same PID namespace in order that
243 the threads in a process can send signals to each other.
244 Similarly, it must be possible to see all of the threads
245 of a processes in the
250 requires being in the same PID namespace;
251 otherwise the process ID of the process sending a signal
252 could not be meaningfully encoded when a signal is sent
253 (see the description of the
257 A signal queue shared by processes in multiple PID namespaces
261 requires all of the threads to be in the same PID namespace,
262 because, from the point of view of a core dump,
263 if two processes share the same address space then they are threads and will
264 be core dumped together.
265 When a core dump is written, the PID of each
266 thread is written into the core dump.
267 Writing the process IDs could not meaningfully succeed
268 if some of the process IDs were in a parent PID namespace.
270 To summarize: there is a technical requirement for each of
275 to share a PID namespace.
276 (Note furthermore that in
285 Thus, call sequences such as the following will fail (with the error
289 unshare(CLONE_NEWPID);
290 clone(..., CLONE_VM, ...); /* Fails */
292 setns(fd, CLONE_NEWPID);
293 clone(..., CLONE_VM, ...); /* Fails */
295 clone(..., CLONE_VM, ...);
296 setns(fd, CLONE_NEWPID); /* Fails */
298 clone(..., CLONE_VM, ...);
299 unshare(CLONE_NEWPID); /* Fails */
302 .\" ============================================================
304 .SS /proc and PID namespaces
307 filesystem shows (in the
309 directories) only processes visible in the PID namespace
310 of the process that performed the mount, even if the
312 filesystem is viewed from processes in other namespaces.
314 After creating a new PID namespace,
315 it is useful for the child to change its root directory
316 and mount a new procfs instance at
318 so that tools such as
321 If a new mount namespace is simultaneously created by including
329 then it isn't necessary to change the root directory:
330 a new procfs instance can be mounted directly over
333 From a shell, the command to mount
337 $ mount -t proc proc /proc
343 yields the process ID of the caller in the PID namespace of the procfs mount
344 (i.e., the PID namespace of the process that mounted the procfs).
345 This can be useful for introspection purposes,
346 when a process wants to discover its PID in other namespaces.
348 .\" ============================================================
351 When a process ID is passed over a UNIX domain socket to a
352 process in a different PID namespace (see the description of
356 it is translated into the corresponding PID value in
357 the receiving process's PID namespace.
359 Namespaces are a Linux-specific feature.
362 .BR user_namespaces (7).
368 .BR capabilities (7),
371 .BR user_namespaces (7),