Container Basics On Linux (Namespaces/Cgroups)

Stop fearing the netns isolation when debugging container traffic

🧩 The Challenge

You’re trying to figure out why your containerized app can’t hit the internal API, but running ping or curl from the host shows everything is perfectly reachable. It is infuriating when you realize the container is living in its own network reality that you cannot see from your main shell.

💡 The Fix

Use the nsenter command to hop directly into the container’s network namespace so you can use your favorite troubleshooting tools right where the traffic actually lives. It saves you from having to install debug packages inside the container itself.

nsenter -t $(docker inspect -f '{{.State.Pid}}' <container_name>) -n ip addr show
nsenter -t $(docker inspect -f '{{.State.Pid}}' <container_name>) -n ping 169.254.1.1

⚙️ Why It Works

By targeting the PID of a process inside the container, this utility forces your current shell to ignore the host’s view of the stack and inherit the isolated namespace assigned to the container. It effectively puts you inside the container’s private network sandbox without needing to exec into the shell of the image.

🚀 Pro-Tip: Run nsenter with a hyphen n and a hyphen m together if you need to check both the network config and the local filesystem mounts at the same time.

Linux Tips & Tricks | © ngelinux.com | 11/9/2026