https://songkou.github.io/tags/virtualization/Recent content in Virtualization on Council of ElrondHugoenFri, 01 Jan 2021 14:52:01 +0800https://songkou.github.io/posts/linux_name_space/Fri, 01 Jan 2021 14:52:01 +0800https://songkou.github.io/posts/linux_name_space/<h1 id="linux-namespace">Linux NameSpace</h1> <p>Docker denpends on Linux NameSpace, Thus this is a brief explaination on linux name space.</p> <p>We can use unshare command to manipulate/playaround with linux name spaces.</p> <h2 id="how-to-check-what-kind-of-linux-namespace-is-supported">How to check what kind of linux namespace is supported</h2> <p>We can use “man unshare” to check what kind of linux namespace is supported. There are 8 types of name spaces:</p> <pre tabindex="0"><code> mount namespace Mounting and unmounting filesystems will not affect the rest of the system (CLONE_NEWNS flag), except for filesystems which are explicitly marked as shared (with mount --make-shared; see /proc/self/mountinfo or findmnt -o+PROPAGATION for the shared flags). unshare automatically sets propagation to private in the new mount namespace to make sure that the new namespace is really unshared. This feature is possible to disable by option --propagation unchanged. Note that private is the kernel default. UTS namespace Setting hostname or domainname will not affect the rest of the system. (CLONE_NEWUTS flag) IPC namespace The process will have an independent namespace for System V message queues, semaphore sets and shared memory segments. (CLONE_NEWIPC flag) network namespace The process will have independent IPv4 and IPv6 stacks, IP routing tables, firewall rules, the /proc/net and /sys/class/net directory trees, sockets, etc. (CLONE_NEWNET flag) pid namespace Children will have a distinct set of PID to process mappings from their parent. (CLONE_NEWPID flag) user namespace The process will have a distinct set of UIDs, GIDs and capabilities. (CLONE_NEWUSER flag) See clone(2) for the exact semantics of the flags. </code></pre><ol> <li>Mount（mnt） isolate mounting space</li> <li>Process ID (pid) isolate process ID.</li> <li>Network (net) isolate network , port ID, etc</li> <li>Interprocess Communication (ipc) isolate System V IPC &amp; POSIX message queues</li> <li>UTS Namespace(uts) Isolate hostname and domain name</li> <li>User Namespace (user) isolate user group and users.</li> </ol> <p>Additionally, Linux 4.6 and 5.6 introduced cgroups and time two types. in total it’s 8.</p>