There's a "how it works" bit at https://orbstack.dev/blog/debug-shell https://orbstack.dev/blog/debug-shell > In particular, mount namespaces are what Docker a

There's a "how it works" bit at https://orbstack.dev/blog/debug-shell https://orbstack.dev/blog/debug-shell > In particular, mount namespaces are what Docker and runc use to give each container its own image and view of the filesystem. But unlike chroot(2), you can copy an existing mount namespace into a new one. Debug Shell uses this to copy a container's namespace, creating a new view where we can inject things without them showing up in the original mount namespace or filesystem.