Container Basics On Linux (Namespaces/Cgroups)
Peek at what your container actually sees
🧩 The Challenge
You ever stare at a container process thinking it’s isolated, but you’ve got no clue which namespaces it’s actually sharing with the host? I spent three hours last week chasing a ghost network interface because I assumed a container had its own stack when it was actually just piggybacking on the host.
đź’ˇ The Fix
Use the lsns command to map out exactly which namespaces a process is stuck in. It’s way better than trying to parse through /proc/PID/ns manually and getting a headache.
lsns -p <PID>⚙️ Why It Works
This utility pulls directly from the proc filesystem to list the namespace IDs for a given PID. Seeing distinct IDs for network or mount namespaces is the only way to be 100 percent sure your isolation is working the way you think it is.
🚀 Pro-Tip: Pipe the output to column -t if you’re looking at a bunch of processes at once to keep the table from looking like a disaster.
Linux Tips & Tricks | © ngelinux.com | 9/14/2026