Container Basics On Linux (Namespaces/Cgroups)

Peer into another process’s namespace without breaking your own shell

🧩 The Challenge

You ever tried to troubleshoot why a specific containerized app can’t see the network interface it’s supposed to, but your host-level tools show everything looking just fine? It’s enough to make you pull your hair out because you’re stuck looking at the host view while the process is living in its own little world.

💡 The Fix

Use the nsenter command to hop into the namespaces of a running process so you can run tools like ip or netstat exactly where the container sees them. You’ll save hours of guessing which veth pair belongs to which container.

PID=$(docker inspect --format '{{.State.Pid}}' container_name)
sudo nsenter -t $PID -n ip addr

⚙️ Why It Works

By grabbing the process ID of the container, you’re telling the kernel to switch your shell’s namespace context to match that specific PID. Everything you run inside that session now happens as if you were sitting right inside that container’s network stack.

🚀 Pro-Tip: Keep in mind you can pass multiple flags like -m or -u to jump into mount or UTS namespaces if you need to debug file paths or hostname issues too.

Linux Tips & Tricks | © ngelinux.com | 11/4/2026