man7/pid_namespaces.7

   1 .\" Copyright (c) 2013 by Michael Kerrisk <mtk.manpages@gmail.com>
   2 .\" and Copyright (c) 2012 by Eric W. Biederman <ebiederm@xmission.com>
   3 .\"
   4 .\" %%%LICENSE_START(VERBATIM)
   5 .\" Permission is granted to make and distribute verbatim copies of this
   6 .\" manual provided the copyright notice and this permission notice are
   7 .\" preserved on all copies.
   8 .\"
   9 .\" Permission is granted to copy and distribute modified versions of this
  10 .\" manual under the conditions for verbatim copying, provided that the
  11 .\" entire resulting derived work is distributed under the terms of a
  12 .\" permission notice identical to this one.
  13 .\"
  14 .\" Since the Linux kernel and libraries are constantly changing, this
  15 .\" manual page may be incorrect or out-of-date.  The author(s) assume no
  16 .\" responsibility for errors or omissions, or for damages resulting from
  17 .\" the use of the information contained herein.  The author(s) may not
  18 .\" have taken the same level of care in the production of this manual,
  19 .\" which is licensed free of charge, as they might when working
  20 .\" professionally.
  21 .\"
  22 .\" Formatted or processed versions of this manual, if unaccompanied by
  23 .\" the source, must acknowledge the copyright and authors of this work.
  24 .\" %%%LICENSE_END
  25 .\"
  26 .\"
  27 .TH PID_NAMESPACES 7 2013-01-14 "Linux" "Linux Programmer's Manual"
  28 .SH NAME
  29 pid_namespaces \- overview of Linux PID namespaces
  30 .SH DESCRIPTION
  31 For an overview of namespaces, see
  32 .BR namespaces (7).
  33
  34 PID namespaces isolate the process ID number space,
  35 meaning that processes in different PID namespaces can have the same PID.
  36 PID namespaces allow containers to provide functionality
  37 such as suspending/resuming the set of processes in the container and
  38 migrating the container to a new host
  39 while the processes inside the container maintain the same PIDs.
  40
  41 PIDs in a new PID namespace start at 1,
  42 somewhat like a standalone system, and calls to
  43 .BR fork (2),
  44 .BR vfork (2),
  45 or
  46 .BR clone (2)
  47 will produce processes with PIDs that are unique within the namespace.
  48
  49 Use of PID namespaces requires a kernel that is configured with the
  50 .B CONFIG_PID_NS
  51 option.
  52 .\"
  53 .\" ============================================================
  54 .\"
  55 .SS The namespace "init" process
  56 The first process created in a new namespace
  57 (i.e., the process created using
  58 .BR clone (2)
  59 with the
  60 .BR CLONE_NEWPID
  61 flag, or the first child created by a process after a call to
  62 .BR unshare (2)
  63 using the
  64 .BR CLONE_NEWPID
  65 flag) has the PID 1, and is the "init" process for the namespace (see
  66 .BR init (1)).
  67 A child process that is orphaned within the namespace will be reparented
  68 to this process rather than
  69 .BR init (1)
  70 (unless one of the ancestors of the child
  71 in the same PID namespace employed the
  72 .BR prctl (2)
  73 .B PR_GET_CHILD_SUBREAPER
  74 command to mark itself as the reaper of orphaned descendant processes).
  75
  76 If the "init" process of a PID namespace terminates,
  77 the kernel terminates all of the processes in the namespace via a
  78 .BR SIGKILL
  79 signal.
  80 This behavior reflects the fact that the "init" process
  81 is essential for the correct operation of a PID namespace.
  82 In this case, a subsequent
  83 .BR fork (2)
  84 into this PID namespace will fail with the error
  85 .BR ENOMEM ;
  86 it is not possible to create a new processes in a PID namespace whose "init"
  87 process has terminated.
  88 Such scenarios can occur when, for example,
  89 a process uses an open file descriptor for a
  90 .I /proc/[pid]/ns/pid
  91 file corresponding to a process that was in a namespace to
  92 .BR setns (2)
  93 into that namespace after the "init" process has terminated.
  94 Another possible scenario can occur after a call to
  95 .BR unshare (2):
  96 if the first child subsequently created by a
  97 .BR fork (2)
  98 terminates, then subsequent calls to
  99 .BR fork (2)
 100 will fail with
 101 .BR ENOMEM .
 102
 103 Only signals for which the "init" process has established a signal handler
 104 can be sent to the "init" process by other members of the PID namespace.
 105 This restriction applies even to privileged processes,
 106 and prevents other members of the PID namespace from
 107 accidentally killing the "init" process.
 108
 109 Likewise, a process in an ancestor namespace
 110 can\(emsubject to the usual permission checks described in
 111 .BR kill (2)\(emsend
 112 signals to the "init" process of a child PID namespace only
 113 if the "init" process has established a handler for that signal.
 114 (Within the handler, the
 115 .I siginfo_t
 116 .I si_pid
 117 field described in
 118 .BR sigaction (2)
 119 will be zero.)
 120 .B SIGKILL
 121 or
 122 .B SIGSTOP
 123 are treated exceptionally:
 124 these signals are forcibly delivered when sent from an ancestor PID namespace.
 125 Neither of these signals can be caught by the "init" process,
 126 and so will result in the usual actions associated with those signals
 127 (respectively, terminating and stopping the process).
 128
 129 Starting with Linux 3.4, the
 130 .BR reboot (2)
 131 system causes a signal to be sent to the namespace "init" process.
 132 See
 133 .BR reboot (2)
 134 for more details.
 135 .\"
 136 .\" ============================================================
 137 .\"
 138 .SS Nesting PID namespaces
 139 PID namespaces can be nested:
 140 each PID namespace has a parent,
 141 except for the initial ("root") PID namespace.
 142 The parent of a PID namespace is the PID namespace of the process that
 143 created the namespace using
 144 .BR clone (2)
 145 or
 146 .BR unshare (2).
 147 PID namespaces thus form a tree,
 148 with all namespaces ultimately tracing their ancestry to the root namespace.
 149
 150 A process is visible to other processes in its PID namespace,
 151 and to the processes in each direct ancestor PID namespace
 152 going back to the root PID namespace.
 153 In this context, "visible" means that one process
 154 can be the target of operations by another process using
 155 system calls that specify a process ID.
 156 Conversely, the processes in a child PID namespace can't see
 157 processes in the parent and further removed ancestor namespace.
 158 More succinctly: a process can see (e.g., send signals with
 159 .BR kill (2),
 160 set nice values with
 161 .BR setpriority (2),
 162 etc.) only processes contained in its own PID namespace
 163 and in descendants of that namespace.
 164
 165 A process has one process ID in each of the layers of the PID
 166 namespace hierarchy in which is visible,
 167 and walking back though each direct ancestor namespace
 168 through to the root PID namespace.
 169 System calls that operate on process IDs always
 170 operate using the process ID that is visible in the
 171 PID namespace of the caller.
 172 A call to
 173 .BR getpid (2)
 174 always returns the PID associated with the namespace in which
 175 the process was created.
 176
 177 Some processes in a PID namespace may have parents
 178 that are outside of the namespace.
 179 For example, the parent of the initial process in the namespace
 180 (i.e., the
 181 .BR init (1)
 182 process with PID 1) is necessarily in another namespace.
 183 Likewise, the direct children of a process that uses
 184 .BR setns (2)
 185 to cause its children to join a PID namespace are in a different
 186 PID namespace from the caller of
 187 .BR setns (2).
 188 Calls to
 189 .BR getppid (2)
 190 for such processes return 0.
 191 .\"
 192 .\" ============================================================
 193 .\"
 194 .SS setns(2) and unshare(2) semantics
 195 Calls to
 196 .BR setns (2)
 197 that specify a PID namespace file descriptor
 198 and calls to
 199 .BR unshare (2)
 200 with the
 201 .BR CLONE_NEWPID
 202 flag cause children subsequently created
 203 by the caller to be placed in a different PID namespace from the caller.
 204 These calls do not, however,
 205 change the PID namespace of the calling process,
 206 because doing so would change the caller's idea of its own PID
 207 (as reported by
 208 .BR getpid ()),
 209 which would break many applications and libraries.
 210
 211 To put things another way:
 212 a process's PID namespace membership is determined when the process is created
 213 and cannot be changed thereafter.
 214 Among other things, this means that the parental relationship
 215 between processes mirrors the parental relationship between PID namespaces:
 216 the parent of a process is either in the same namespace
 217 or resides in the immediate parent PID namespace.
 218 .SS Compatibility of CLONE_NEWPID with other CLONE_* flags
 219 .BR CLONE_NEWPID
 220 can't be combined with some other
 221 .BR CLONE_*
 222 flags:
 223 .IP * 3
 224 .B CLONE_THREAD
 225 requires being in the same PID namespace in order that that
 226 the threads in a process can send signals to each other.
 227 Similarly, it must be possible to see all of the threads
 228 of a processes in the
 229 .BR proc (5)
 230 filesystem.
 231 .IP *
 232 .BR CLONE_SIGHAND
 233 requires being in the same PID namespace;
 234 otherwise the process ID of the process sending a signal
 235 could not be meaningfully encoded when a signal is sent
 236 (see the description of the
 237 .I siginfo_t
 238 type in
 239 .BR sigaction (2)).
 240 A signal queue shared by processes in multiple PID namespaces
 241 will defeat that.
 242 .IP *
 243 .BR CLONE_VM
 244 requires all of the threads to be in the same PID namespace,
 245 because, from the point of view of a core dump,
 246 if two processes share the same address space they are threads and will
 247 be core dumped together.
 248 When a core dump is written, the PID of each
 249 thread is written into the core dump.
 250 Writing the process IDs could not meaningfully succeed
 251 if some of the process IDs were in a parent PID namespace.
 252 .PP
 253 To summarize: there is a technical requirement for each of
 254 .BR CLONE_THREAD ,
 255 .BR CLONE_SIGHAND ,
 256 and
 257 .BR CLONE_VM
 258 to share a PID namespace.
 259 (Note furthermore that in
 260 .BR clone (2)
 261 requires
 262 .BR CLONE_VM
 263 to be specified if
 264 .BR CLONE_THREAD
 265 or
 266 .BR CLONE_SIGHAND
 267 is specified.)
 268 Thus, call sequences such as the following will fail (with the error
 269 .BR EINVAL ):
 270
 271 .nf
 272     unshare(CLONE_NEWPID);
 273     clone(..., CLONE_VM, ...);    /* Fails */
 274
 275     setns(fd, CLONE_NEWPID);
 276     clone(..., CLONE_VM, ...);    /* Fails */
 277
 278     clone(..., CLONE_VM, ...);
 279     setns(fd, CLONE_NEWPID);      /* Fails */
 280
 281     clone(..., CLONE_VM, ...);
 282     unshare(CLONE_NEWPID);        /* Fails */
 283 .fi
 284 .\"
 285 .\" ============================================================
 286 .\"
 287 .SS /proc and PID namespaces
 288 A
 289 .I /proc
 290 filesystem shows (in the
 291 .I /proc/PID
 292 directories) only processes visible in the PID namespace
 293 of the process that performed the mount, even if the
 294 .I /proc
 295 filesystem is viewed from processes in other namespaces.
 296
 297 After creating a new PID namespace,
 298 it is useful for the child to change its root directory
 299 and mount a new procfs instance at
 300 .I /proc
 301 so that tools such as
 302 .BR ps (1)
 303 work correctly.
 304 If a new mount namespace is simultaneously created by including
 305 .BR CLONE_NEWNS
 306 in the
 307 .IR flags
 308 argument of
 309 .BR clone (2)
 310 or
 311 .BR unshare (2),
 312 then it isn't necessary to change the root directory:
 313 a new procfs instance can be mounted directly over
 314 .IR /proc .
 315
 316 From a shell, the command to mount
 317 .I /proc
 318 is:
 319
 320     $ mount -t proc proc /proc
 321
 322 Calling
 323 .BR readlink (2)
 324 on the path
 325 .I /proc/self
 326 yields the process ID of the caller in the PID namespace of the procfs mount
 327 (i.e., the PID namespace of the process that mounted the procfs).
 328 This can be useful for introspection purposes,
 329 when a process wants to discover its PID in other namespaces.
 330 .\"
 331 .\" ============================================================
 332 .\"
 333 .SS Miscellaneous
 334 When a process ID is passed over a UNIX domain socket to a
 335 process in a different PID namespace (see the description of
 336 .B SCM_CREDENTIALS
 337 in
 338 .BR unix (7)),
 339 it is translated into the corresponding PID value in
 340 the receiving process's PID namespace.
 341 .SH CONFORMING TO
 342 Namespaces are a Linux-specific feature.
 343 .SH EXAMPLE
 344 See
 345 .BR user_namespaces (7).
 346 .SH SEE ALSO
 347 .BR clone (2),
 348 .BR setns (2),
 349 .BR unshare (2),
 350 .BR proc (5),
 351 .BR credentials (7),
 352 .BR capabilities (7),
 353 .BR user_namespaces (7),
 354 .BR switch_root (8)