Lightweight process virtualization technology that provides an isolated environment within the same system, using each separate, independent space.
Unlike the hypervisor that virtualizes hardware, it is a technology that operates on the same OS but distinguishes itself from the execution environment itself.
Technically, it uses the unshare() and setns() system calls, and implement the six constant flags described below by passing them to the clone (), unshare (), and setns () system calls.
| namespace | describe |
|---|---|
| mnt | CLONE_NEWNS |
| uts | CLONE_NEWUTS |
| ipc | CLONE_NEWIPC |
| pid | CLONE_NEWPID |
| usr | CLONE_NEWUSER |
| net | CLONE_NEWNET |
This copy allows the newly created process to make changes, such as mounting or unmounting the file system, without affecting the parent process.
At the time this copy was created, the mount and unmount of the default namespace for the file system is visible to all processes. And changes in each process-specific mount namespace are not known outside the process's namespace.
Unmount the namespace before mounting.
[root@localhost/]# mkdir /tmp/mount_ns
[root@localhost/]#
[root@localhost/]# unshare -m /bin/bash
* unshare : How to separate namespaces
* -m : Mount Namespace
Use the readlink command to check the mount information of the current process.
[root@localhost/] # readlink /proc/$$/ns/mnt
mnt: [4026532190]
[root@localhost/] #
* readlink : follows the origin of the symbolic link.
* $$ : Process ID of the current bash shell
* /proc/ : Various real-time information and files stored in the system.
(In Linux, the virtual file system is located in the virtual reality storage memory.)
Check the tmpfs file system for file system information.
[root@localhost/] # mount -n -t tmpfs tmpfs / tmp / mount_ns
[root@localhost/] #
[root@localhost/] # df -h | grep mount_ns
tmpfs 1.9G 0 1.9G 0% / tmp / mount_ns
* mount -n option : setting for /etc/mtab (/etc/mtab : mount information of current system)
* mount -t tmpfs Option : Verify file system mount
* df : Display file system
* df -h : human readable option
Please check the file system information further.
[root@localhost/] # cat /proc/mounts | grep mount_ns
tmpfs/tmp/mount_ns tmpfs rw, seclabel, relatime 0 0
[root@localhost/] #
Check again.
Separate mounted file systems are invisible.
[root@localhost~] #
[root@localhost~] # readlink /proc/$$/ns/mnt
mnt: [4026531840]
[root@localhost~] # cat/proc/mounts | grep mount_ns
[root@localhost~] # df -h | grep mount_ns
[root@localhost~] #
[root@localhost ~]# hostname
localhost.localdomain
[root@localhost ~]#
Then use the unshare -u command to split the UTS namespace.
After partitioning, make sure that the hostname has changed after setting the new hostname.
[root@localhost ~]# unshare -u /bin/bash
[root@localhost ~]# hostname uts-namespace
[root@localhost ~]#
[root@localhost ~]# hostname
uts-namespace
[root@localhost ~]# cat /proc/sys/kernel/hostname
uts-namespace
[root@localhost ~]#
If you open a new session again and check the hostname, you can see that the hostname in the namespace you just separated is not visible.
[root@localhost ~]#
[root@localhost ~]#
[root@localhost ~]# hostname
localhost.localdomain
[root@localhost ~]#
You can see the lo and enp0s3 interfaces by querying the current interface using the ip command.
[root@localhost ~]# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
...(skip)
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
...(skip)
[root@localhost ~]#
The path from the root network namespace can be seen below.
[root@localhost ~]#
[root@localhost ~]# ip r s
default via 10.0.2.2 dev enp0s3 proto static metric 100
10.0.2.0/24 dev enp0s3 proto kernel scope link src 10.0.2.15 metric 100
...(skip)
[root@localhost ~]#
Now create two new network namespaces.
[root@localhost ~]#
[root@localhost ~]# ip netns add ns1
[root@localhost ~]# ip netns add ns2
[root@localhost ~]#
[root@localhost ~]# ip netns
ns2
ns1
[root@localhost ~]#
It then launches a new network command within the new namespace.
Within the new namespace network, you can see that there is only one loopback interface.
[root@localhost ~]# ip netns exec ns1 ip link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
[root@localhost ~]#