Container Basics On Linux (Namespaces/Cgroups)
Peer inside a running container process without breaking containment
🧩 The Challenge
Trying to debug why a containerized app is losing network connectivity is a nightmare when you can’t see the internal interface configuration. You end up trying to install iproute2 inside the container, which is a massive security risk and a total waste of time.
đź’ˇ The Fix
Use nsenter to drop your own shell directly into the specific namespace of the running process. It lets you run tools from your host environment on a container’s isolated network stack.
PID=$(docker inspect -f '{{.State.Pid}}' <container_name>)
nsenter -t $PID -n ip addr⚙️ Why It Works
By grabbing the process ID of the container, you’re telling the kernel to switch your current shell session into that specific process’s network namespace. It’s like having a window into their world without having to climb inside the house.
🚀 Pro-Tip: Use the -m and -u flags with nsenter if you need to check the container’s mount points or hostname while you’re at it.
Linux Tips & Tricks | © ngelinux.com | 10/24/2026