This document discusses Linux namespaces, which allow isolation and virtualization of system resources like process IDs, network interfaces, mounted filesystems, and more. It provides examples of different namespace types like UTS, user, PID, IPC, mount, and network namespaces. It also covers the kernel configuration and software implementation using clone() and setns() system calls to create and join namespaces.

1. Linux Linux
NamespacesNamespaces

2. Why do we need that?Why do we need that?

3. What namespaces do we have?What namespaces do we have?
● UTS namespace
● User namespace
● PID namespace
● IPC namespace
● Mount namespace
● Network namespace

4. Kernel configuration?Kernel configuration?
General Setup -> Namespaces support -> *
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y

5. Software implementationSoftware implementation
#include <sched.h>
int clone(int (*fn)(void *), void *child_stack,
int flags, void *arg, ...
/* pid_t *ptid, struct user_desc *tls, pid_t *ctid */ );
clone() creates a new process...
CLONE_NEWUTS CLONE_NEWIPC
CLONE_NEWNET CLONE_NEWPID
CLONE_NEWNS CLONE_NEWUSER

6. Software implementationSoftware implementation
#include <sched.h>
int setns(int fd, int nstype);
Given a file descriptor referring to a namespace,
reassociate the calling thread with that namespace.
Supports:
CLONE_NEWIPC
CLONE_NEWNET
CLONE_NEWUTS

7. UTS namespaceUTS namespace
The server is installed in Chicago.
Timezone: North America -> US -> Chicago
App requires timezone: Europe -> London
If the app can not handle the timezone change by its
own... we have three choices:
1. Create a chrooted environment with different default
timezone
2. Create a virtual machine and put the app there
3. Create a new UTS namespace and start the app in it

8. User namespaceUser namespace
User authentication and mapping files:
● /etc/passwd
● /etc/group
● /etc/shadow
- What if we want to create a username called
pesho, but such user already exists?
- What if we want to create user joan with UID 1005,
but there is already user pesho with UID 1005?

9. IPC namespaceIPC namespace
Unix/Linux IPCs
- unix domain sockets
- shared memory
- semaphores
- message queues
/proc/PID/fd/
|- 3 -> socket:[3537]

10. IPC namespaceIPC namespace
Unix/Linux IPCs
- unix domain sockets
- shared memory
- semaphores
- message queues
key shmid owner perms bytes nattch
0x0052e2c1 1139834880 postgres 600 37879808 4

11. Network namespaceNetwork namespace
- IP
- IPv6
- Routing
- TCP
- UDP
- SCTP
- DCCP
- RDS
● Having а separate
loopback device for a process
● Or simply test the MySQL
server on the same IP
● Completely different routing
for a process

12. Mount namespaceMount namespace
the most complex one...
having only one / is a problem...
- at around 22000 mounts everything on your
machine starts to lag... no matter how many cores
or ram you have :(
- having a different /proc/mounts per process would
be nice and very interesting to implement... :)

13. PID namespacePID namespace
Migration of processes between machines (CRIU)
It allows you to have a two or more processes
running with the same PID.
PID - is the PID on the host machine
NSPID - is the PID that the process sees
PID NSPID
1421 5420 ssh-agent
1730 5420 xchat
1756 5420 firefox