Container Basics On Linux (Namespaces/Cgroups)

Peek inside a running containers isolated world without entering it

🧩 The Challenge

You’re trying to debug why a process inside a container is behaving like a lunatic, but you don’t want to mess with its environment by shelling in. Everything looks like a black box until you actually have to see what the kernel sees.

💡 The Fix

Use nsenter to borrow the namespace of the PID running the show. It lets you run commands as if you were sitting right there inside the container’s guts without ever actually touching the container’s init process.

nsenter -t <PID> -n ip addr
nsenter -t <PID> -m ps aux

⚙️ Why It Works

By pointing at the target PID, you’re telling the kernel to switch your own shell’s namespace to match. It’s cleaner than installing tools inside a stripped-down production image that shouldn’t have them anyway.

🚀 Pro-Tip: Use the -m and -n flags to target mount and network namespaces specifically; don’t just jump into everything if you don’t need to.

Linux Tips & Tricks | © ngelinux.com | 11/1/2026