Container Basics On Linux (Namespaces/Cgroups)

See what a container process is doing without entering its namespace

🧩 The Challenge

Trying to debug a container that feels sluggish often leads people to exec into it, but that adds overhead and changes the environment. I’ve wasted hours trying to figure out why a process inside a pod was stalling, only to realize my presence was masking the race condition.

💡 The Fix

Use the unshare and nsenter tools to peek into the process’s view of the world from your host shell without actually jumping inside. It keeps your debugging tools separate from the container’s limited runtime.

nsenter -t <PID> -n -p -m -u -i -n ip a
nsenter -t <PID> -p ps aux

⚙️ Why It Works

These flags attach your current shell process to the existing namespaces of a target PID, essentially letting you see the networking, process tree, and mount points exactly as that container sees them. It’s like wearing the container’s glasses while keeping your own feet firmly on the host.

🚀 Pro-Tip: Grab the PID from the host’s process tree instead of the container runtime’s list to avoid any abstraction leaks.

Linux Tips & Tricks | © ngelinux.com | 9/7/2026