Container Basics On Linux (Namespaces/Cgroups)

Peek at what your container actually sees

🧩 The Challenge

You ever stare at a container process thinking it’s isolated, but you’ve got no clue which namespaces it’s actually sharing with the host? I spent three hours last week chasing a ghost network interface because I assumed a container had its own stack when it was actually just piggybacking on the host.

💡 The Fix

Use the lsns command to map out exactly which namespaces a process is stuck in. It’s way better than trying to parse through /proc/PID/ns manually and getting a headache.

lsns -p <PID>

⚙️ Why It Works

This utility pulls directly from the proc filesystem to list the namespace IDs for a given PID. Seeing distinct IDs for network or mount namespaces is the only way to be 100 percent sure your isolation is working the way you think it is.

🚀 Pro-Tip: Pipe the output to column -t if you’re looking at a bunch of processes at once to keep the table from looking like a disaster.

Linux Tips & Tricks | © ngelinux.com | 9/14/2026