Container Basics On Linux (Namespaces/Cgroups)

Peer inside a running container process without breaking containment

🧩 The Challenge

Trying to debug why a containerized app is losing network connectivity is a nightmare when you can’t see the internal interface configuration. You end up trying to install iproute2 inside the container, which is a massive security risk and a total waste of time.

💡 The Fix

Use nsenter to drop your own shell directly into the specific namespace of the running process. It lets you run tools from your host environment on a container’s isolated network stack.

PID=$(docker inspect -f '{{.State.Pid}}' <container_name>)
nsenter -t $PID -n ip addr

⚙️ Why It Works

By grabbing the process ID of the container, you’re telling the kernel to switch your current shell session into that specific process’s network namespace. It’s like having a window into their world without having to climb inside the house.

🚀 Pro-Tip: Use the -m and -u flags with nsenter if you need to check the container’s mount points or hostname while you’re at it.

Linux Tips & Tricks | © ngelinux.com | 10/24/2026