3.5 Namespaces 2

Structure

• Introduction
• Mount Namespace
• User Namespace
• IPC Namespace
• CGroup Namespace
• Time Namespace
• Containers and Host
• Conclusions

Bibliography

(i.e., material that you must read to study the lesson)

• “Container Security”, Liz Rice, Chap. 4 (2nd edition!) (from “Mount Namespace” until the end, excluding Network NS)

Other useful information and other links

(i.e., material that you may want to read to deepen the comprehension)

• namespaces(7) - Linux manual page
• Slides dalla Thematic CERN school of computing container-security
• "Making Containers More Isolated: An Overview of Sandboxed Container Technologies" https://unit42.paloaltonetworks.com/making-containers-more-isolated-an-overview-of-sandboxed-container-technologies/

Recap Questions

(recap questions that can help you revise the material you studied and that may be also asked at the oral exam 😊 )

• What is a mount/user/IPC/Cgroup/Time namespace?
• How do you use mount/user/IPC/Cgroup/Time namespace?
• What is the purpose of mount/user/IPC/Cgroup/Time namespace?
• Why do we need for mount NS also to have a different root, like for PIDs namespace?
• How do you map users from host to a container?
• Why do we need for CGroups NS also to have a different root, like for PIDs namespace?
• Why is “Containerized process” a better name for containers?
• In terms of security what is the fundamental difference between containers and Virtual Machines?
• Why it is advisable to have a separate (bare or virtual) machine for running containers?
• Why limiting the number of users on the machine that holds the container is a good strategy?
• Why using thin, limited OS distributions for the machine that holds the container is a good idea?
• Why is it important to have immutable machines (no patch but reinstallation)