Container Basics On Linux (Namespaces/Cgroups)

Peek inside a containers process tree without entering it

🧩 The Challenge

Trying to debug a container that feels like a black box is a nightmare, especially when you need to see what processes are actually doing inside their own mount namespace without breaking into the container with an interactive shell. I’ve wasted so many hours spinning up nsenter sessions just to realize I was looking at the wrong PID.

💡 The Fix

Use lsns to find the namespace identifier and then pull the process list directly from the host context using ps. It saves you from having to mess around with entering the container’s environment just to run a quick status check.

PID=$(docker inspect --format '{{.State.Pid}}' <container_name_or_id>)
nsenter -t $PID -p -m ps aux

⚙️ Why It Works

By tagging the namespace with -p for PID and -m for mount, you force your tools to peer through the container’s private view of the filesystem and process tree. It’s essentially a transparent window into another world while you stay safely on the host.

🚀 Pro-Tip: Use the -n flag with nsenter if you also need to check the container’s private network stack settings.

Linux Tips & Tricks | © ngelinux.com | 7/16/2026