World map

 

BM

World D6: Under the Hood

Namespaces: what it can see

You will learn: how Linux namespaces give a process its own processes, network and hostname.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

This plain process, node server.js, sees every program on the laptop. Inside a container, ps showed just one. Flip the two switches and watch.

Turn on PID, then Mount. Watch the process list.

What it can see (namespaces)

  • Processes it sees

    • 1 /sbin/init
    • 412 sshd
    • 655 containerd
    • 701 dockerd
    • 1880 firefox
    • 4242 node server.js← this process

  • Files it sees

    • /home/aina/kedai/server.js
    • /home/aina/.ssh/id_ed25519
    • /home/aina/Photos/
    • /var/lib/docker/

Watch

Your laptop~

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

Two different names! Each switch is a namespace (Linux): Blinkers for a process: it sees only its own processes, network, files or hostname. Not a Kubernetes namespace.. A namespace is a pair of blinkers. It hides one thing, like the laptop’s hostname.

Try it

Find the blinker that gives the process its own network card.

Which switch gives it its own network?

What it can see (namespaces)

  • Network

    • lo 127.0.0.1
    • wlan0 192.168.1.20
    • docker0 172.17.0.1

  • Hostname

    aina-laptop

  • Shared memory

    • shared memory from firefox
    • shared memory from pulseaudio

Predict

Two nginx containers both listen on port 80 inside. Will they clash?

Try it

Prove it. Start a second nginx called web2, without -p.

Your laptop~

Lunchboxes (containers)

  • webrunning
    from nginx:1.30-alpine 8080→80

Frozen packs (images)

  • nginx:1.30-alpine8 layers · 93.5MB · in use

Check

Which namespace hides each thing?

Drag a card into a box. Or tap the card, then tap the box.

        You did it!

        You can now explain how namespaces change what a container sees.

        Go deeper (optional)

        Linux has 8 kinds: cgroup, IPC, network, mount, PID, time, user and UTS. Docker turns on PID, mount, network, UTS and IPC (plus cgroup on cgroup v2). The user one stays off by default (lesson 6). A Kubernetes namespace is a different idea: a zone of the food court.

        Real rep (optional, Linux): make your own namespaces.

        Real mission

        1. sudo unshare --uts --pid --fork --mount-proc sh
        2. hostname kancil
        3. ps
        4. exit

        0 of 4 steps done · Your ticks are saved.