Container Basics On Linux (Namespaces/Cgroups)

Peek inside a containers namespace without leaving your shell

🧩 The Challenge

You are debugging a stuck container and everything looks fine from the host, but the process inside is acting like it has zero network access. It is incredibly frustrating trying to figure out which network namespace your container actually grabbed.

💡 The Fix

Use the nsenter command to hop into the namespace of a running process. It lets you run commands as if you were sitting right inside that container environment, saving you from guessing what the networking stack is doing.

nsenter -t $(docker inspect --format '{{.State.Pid}}' <container_name>) -n ip addr

⚙️ Why It Works

By grabbing the PID from the container’s metadata and passing it to nsenter with the -n flag, you force the shell to look at that specific process’s network namespace instead of the host’s. You see exactly what the container sees, no more and no less.

🚀 Pro-Tip: Add -m or -u flags to that command to check out the mount or UTS namespaces if you’re chasing filesystem or hostname mysteries.

Linux Tips & Tricks | © ngelinux.com | 7/23/2026