3 ms·

Digging into Linux namespaces – part 1

141 points by pcw888 5y ago

bram_stoker 5y ago
You must be 007 :)
egberts1 5y ago
Nicely demonstrated but I actually had to type this in (cut-n-paste) these commands to understand. Probably could IMHO benefit from some simpler sentences to help most like-minded engineers to bridge the Linux namespace knowledge gap and get there quicker. THEN again, I am not most like-minded engineers, just a lowly zero-buf network software architect for a layer-5 IPS/IDS system. At any rate, it’s a great article of HOWTO “get there” due to its actual inner-working and interactivity between network realms being exposed. Keep it up.
guardiangod 5y ago
Good article. I mostly deal with the NET namespace (eg. 100+ VPN WAN source-base router + IDS lol) but I've never read an article that explore other namespaces in detail.
- boibombeiro 5y ago
  I agree. Most articles seems to be about VMS. I want to use cgroups and namespace to manange apps I use daily and that can be easily compromised. Things like, neovim plugins, the terminal (kitty now edits the zshrc) etc. I am aware of sandbox tools, like firejail. But wish there was more resources on how to manange local apps.
asicsp 5y ago
Link for part 2: https://blog.quarkslab.com/digging-into-linux-namespaces-part-2.html https://blog.quarkslab.com/digging-into-linux-namespaces-par...
tyingq 5y ago
A good follow on after this would be looking at the source code for bocker. It's a clone of large parts of docker, but in about 100 lines of bash. You'll see references to nsenter, cgcreate, cgdelete, cgexec, and so on. It's helpful to see how docker is mostly a veneer over things that are already in Linux. Not discounting docker, but a lot of the actual value is in things like Docker Hub and Docker Desktop versus the runtime itself. https://github.com/p8952/bocker/blob/master/bocker https://github.com/p8952/bocker/blob/master/bocker
- yjftsjthsd-h 5y ago
  Absolutely, the "secret sauce" is in the tooling and workflows. Other OSs have great container tech underneath - illumos zones and FreeBSD jails - but without the ease of use and ease of moving around images, they're a lot less useful.
rank0 5y ago
This article is seriously awesome. I’ve never heard of this firm but I plan on reading their other blog content.
5e92cb50239222b 5y ago
I also recommend this series: https://lwn.net/Articles/531114/ https://lwn.net/Articles/531114/ (links to later parts at the end of the article). Plus this https://lwn.net/Articles/604609/ https://lwn.net/Articles/604609/ for a related concept (cgroups).
usrme 5y ago
I would also throw this blog post series into the ring: https://www.schutzwerk.com/en/43/posts/linux_container_intro/ https://www.schutzwerk.com/en/43/posts/linux_container_intro.... It can be quite terse at times, but seeing as it's not overly long it can still serve as good supplemental material.

141 points by pcw888 5y ago

You must be 007 :)

Nicely demonstrated but I actually had to type this in (cut-n-paste) these commands to understand. Probably could IMHO benefit from some simpler sentences to help most like-minded engineers to bridge the Linux namespace knowledge gap and get there quicker. THEN again, I am not most like-minded engineers, just a lowly zero-buf network software architect for a layer-5 IPS/IDS system. At any rate, it’s a great article of HOWTO “get there” due to its actual inner-working and interactivity between network realms being exposed. Keep it up.

guardiangod 5y ago

Good article. I mostly deal with the NET namespace (eg. 100+ VPN WAN source-base router + IDS lol) but I've never read an article that explore other namespaces in detail.

boibombeiro 5y ago
I agree. Most articles seems to be about VMS. I want to use cgroups and namespace to manange apps I use daily and that can be easily compromised. Things like, neovim plugins, the terminal (kitty now edits the zshrc) etc. I am aware of sandbox tools, like firejail. But wish there was more resources on how to manange local apps.

asicsp 5y ago

Link for part 2: https://blog.quarkslab.com/digging-into-linux-namespaces-part-2.html https://blog.quarkslab.com/digging-into-linux-namespaces-par...

tyingq 5y ago

A good follow on after this would be looking at the source code for bocker. It's a clone of large parts of docker, but in about 100 lines of bash. You'll see references to nsenter, cgcreate, cgdelete, cgexec, and so on. It's helpful to see how docker is mostly a veneer over things that are already in Linux. Not discounting docker, but a lot of the actual value is in things like Docker Hub and Docker Desktop versus the runtime itself. https://github.com/p8952/bocker/blob/master/bocker https://github.com/p8952/bocker/blob/master/bocker

yjftsjthsd-h 5y ago
Absolutely, the "secret sauce" is in the tooling and workflows. Other OSs have great container tech underneath - illumos zones and FreeBSD jails - but without the ease of use and ease of moving around images, they're a lot less useful.

rank0 5y ago

This article is seriously awesome. I’ve never heard of this firm but I plan on reading their other blog content.

5e92cb50239222b 5y ago

I also recommend this series: https://lwn.net/Articles/531114/ https://lwn.net/Articles/531114/ (links to later parts at the end of the article). Plus this https://lwn.net/Articles/604609/ https://lwn.net/Articles/604609/ for a related concept (cgroups).

usrme 5y ago

I would also throw this blog post series into the ring: https://www.schutzwerk.com/en/43/posts/linux_container_intro/ https://www.schutzwerk.com/en/43/posts/linux_container_intro.... It can be quite terse at times, but seeing as it's not overly long it can still serve as good supplemental material.