Namespaces are used to provide a process or a group of processes with the idea of being the only process or group of processes in the system.
They are a way to detach processes from a specific kernel layer assigning them to a new one. Or in other words, they are indirections layers for global resources.
Lets imagine this as an extension to classical chroot() syscall. When setting a new root calling chroot, kernel was isolating new branch from existing one, and thus creating a new namespace for the process.
Namespaces now provide the basis for a complete lightweight virtualization system, in the form of containers.
Currently, linux support following namespaces
domain and hostname
queues, semaphores, and shared memmory
IP, routes, network devices…
I let individual namespaces explanations as simple as this, or in other words, for another day.
In Linux kernel there are not distinction between process and threads implementions, threads are just light weight processes. Threads are also created by calling clone() but with different arguments (CLONE_VM mainly). From the kernel point of view, a process/thread is a task.
Namespaces can be nested. Limit for nesting namespaces is 32.
Per process namespaces can be found under /proc/$pid/ns.
$ ls -l /proc/$$/ns
lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 ipc -> ipc:lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 mnt -> mnt:lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 net -> net:lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 pid -> pid:lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 user -> user:lrwxrwxrwx 1 ubuntu ubuntu 0 Jan 5 21:12 uts -> uts:
Each process namespace has an inode number, that corresponds with a namespace struct. If two tasks share same number, they belongs to same namespace. Inode for ns files in namespaces is not the same as stat -c %i shows. They are sym links.
For namespaces, like sockets or pipes inode number is shown in form type:[inode].
# for pid in 643 23681 32178 ; do readlink /proc/$pid/ns/mnt ; donemnt:mnt:mnt:# for pid in 643 23681 32178 ; do md5sum /proc/$pid/mounts ; done8dddf7d919672a56849bb487840b94e0 /proc/643/mounts
# unshare -m /bin/bash # readlink /proc/$$/ns/mntmnt:# for pid in 643 23681 32178; do stat -c %i /proc/$pid/ns/mnt ; done1308868
Proc namespaces files are implemented through proc_ns_operations struct.