Namespaces

Primary isolation feature used for containers

Processes can be isolated in the following namespaces:

Containers isolate all namespaces by default

Can be nested

Demo: Namespaces

See namespaces.demo

(Very extensive and does not fit on a slide.)

The nginx container image does not contain ps

Run nginx container:

docker run -d --name web nginx

Check for ps (missing):

docker exec -it web \
    whereis ps

Share PID namespace to use ps:

docker run -it --rm --pid container:web ubuntu:hirsute \
    ps fauxww

The same works for other namespaces