Container Basics On Linux (Namespaces/Cgroups)

Don’t let your process see what it’s not supposed to see

🧩 The Challenge

You ever have a process you just need to isolate, but you don’t want the full overhead of Docker? Sometimes you just want to run a command and make sure it can’t touch the rest of your filesystem or network, and it’s frustrating how few people know how to do this natively.

💡 The Fix

Use unshare to create a fresh namespace environment for your shell. It gives you a clean sandbox without needing to pull down images or install extra runtimes.

sudo unshare -rmf --mount-proc chroot /mnt/empty_dir /bin/bash

⚙️ Why It Works

By telling the kernel to unshare the mount and user namespaces, you effectively trick the process into thinking it’s the root of a brand new, empty world. The –mount-proc flag is the secret sauce here, because it remounts /proc so the process doesn’t see your host’s actual process list.

🚀 Pro-Tip: Use the -n flag if you want to completely sever its network connection and keep it truly isolated from your local subnet.

Linux Tips & Tricks | © ngelinux.com | 9/20/2026