Container Basics On Linux (Namespaces/Cgroups)

See what your container is actually hiding from the host

🧩 The Challenge

You ever try to kill a zombie process inside a container from the host and get “No such process” even though you can see it in your container logs? It’s because the PID you see on the host is just the kernel’s way of dealing with namespaces, and it’s a total headache when you are trying to debug cross-namespace visibility.

💡 The Fix

Use the nsenter utility to enter the specific namespaces of a container process so you can run commands as if you were sitting inside that container’s sandbox. It clears up all the confusion about what files and processes are actually reachable.

nsenter --target $(docker inspect --format '{{.State.Pid}}' <container_name>) --mount --uts --ipc --net --pid

⚙️ Why It Works

By explicitly switching your shell into the target process’s namespace, you effectively bypass the host’s restricted view. You are essentially tricking your tools into thinking they belong inside the container environment you are currently fighting with.

🚀 Pro-Tip: Alias this to ‘enter-container’ with a positional argument for the name—you will thank yourself at 3 AM.

Linux Tips & Tricks | © ngelinux.com | 10/18/2026