Container Basics On Linux (Namespaces/Cgroups)

Inspecting Process Isolation via Unshare Namespace Mapping

🧩 The Challenge

It is difficult to visualize which specific kernel namespaces are currently partitioning a process from the rest of the host system. Identifying if a process is truly isolated requires digging into the link targets of its runtime descriptors.

💡 The Fix

Use the stat command to inspect the inode numbers of the symbolic links located within the process-specific namespace directory under procfs. Processes sharing the same inode numbers for a namespace type are part of the same isolation boundary.

ls -l /proc/self/ns/
stat -c %i /proc/self/ns/pid

⚙️ Why It Works

The Linux kernel assigns a unique inode number to every namespace; by comparing these identifiers, you can programmatically verify if two containers or processes are sharing the same execution environment.

🚀 Pro-Tip: Use the nsenter command with the target PID to instantly spawn a new shell inside the specific namespace environment you identified.

Linux Tips & Tricks | © ngelinux.com | 7/8/2026