Container Basics On Linux (Namespaces/Cgroups)

Quick Sandbox: Run Commands in Their Own Isolated World

🧩 The Challenge

Ever just wanted to run a single command or a small script in its own environment, completely separate from your host’s network, process list, or filesystem mounts? You don’t want to spin up a whole Docker container or a VM just for a quick test. It’s a pain to clean up after yourself when you’re just messing around.

💡 The Fix

Forget the heavyweight container runtimes for a second. There’s a built-in kernel tool that gives you a lightweight, temporary sandbox by creating new namespaces on demand. You can launch a shell or any command into its own private world.

unshare --fork --pid --mount --net --uts --ipc bash
# Once inside this new shell, your environment is isolated.
# To see the isolated process tree, type: ps aux
# For network: ip a
# To properly mount the new /proc filesystem: mount -t proc proc /proc
# Then you can run commands like:
# ip link set lo up
# ip addr add 127.0.0.1/8 dev lo
# ping -c 1 127.0.0.1
# Type 'exit' to leave the isolated shell.

⚙️ Why It Works

This command directly taps into Linux namespaces, the very foundation of containers. Each `–namespace` option tells the kernel to create a fresh, empty isolation for that specific resource. You get a private process tree (after mounting `/proc`), an empty network stack, and a distinct mount table that all vanish when your unshared process (the `bash` shell, in this case) exits.

🚀 Pro-Tip: Pair `chroot` with the `unshare` command for an even more isolated environment, making it feel like a truly clean OS install for your temporary tests.

Linux Tips & Tricks | © ngelinux.com | 9/18/2026