3.4 Namespaces 1
Structure
- Introduction
- Linux Namespaces
- Isolating Hostname
- Process IDs Namespaces
- Conclusions
Bibliography
(i.e., material that you must read to study the lesson)
- “Container Security”, Liz Rice, Chap. 4 (2nd edition!) (until “Mount Namespace” excluded)
- Plan 9 from Bell Labs - Wikipedia , only the introduction (before “History”, excluded) and the first paragraph of “Design concepts”
- Unshare -fork explained in linux - unshare --pid /bin/bash - fork cannot allocate memory - Stack Overflow
Other useful information and other links
(i.e., material that you may want to read to deepen the comprehension)
- Presotto, Dave; Pike, Rob; Thompson, Ken; Trickey, Howard. “Plan 9, A Distributed System”. Proc. Spring 1991 EurOpen Conference 158c: an architectural paper for Plan 9
- Plan 9 from Bell Labs - Wikipedia
- unshare(1) - Linux manual page
- mount(8) - Linux manual page
- A nice blog about PIDs namespace with some examples: https://blog.sysxplore.com/p/part-2-linux-namespaces-pid-namespaces
Recap Questions
(recap questions that can help you revise the material you studied and that may be also asked at the oral exam 😊 )
- What are the two main problems in isolating a process running in a container?
- And how are they solved by cgroups and namespaces?
- What are namespaces, and how many (and which) do we use?
- What is UTS namespace?
- What is Plan 9 and what are its main characteristics?
- What is the metaphore “everything is a file” in Unix and Plan9?
- What is the capability based security introduced in Plan 9 and does it compare to Unix access control list?
- What does the command unshare do?
- When you unshare UTS namespace, what a child shell can do?
- Why is the parameter --fork needed when we unshare the PID namespace?
- What does chroot command does?
- Why is the chroot needed together with the unshare PID namespace command?