Container Basics On Linux (Namespaces/Cgroups)

Stop guessing why your process cant see the network

🧩 The Challenge

You are trying to debug a container that acts like it has zero network connectivity, but you are staring at a perfectly valid interface inside the shell. It is infuriating when you realize you are looking at the host’s perspective, not the container’s isolated world.

💡 The Fix

Use nsenter to drop your shell directly into the target process’s network namespace. It saves you from having to hop through layers of container runtimes just to run a single ping or tcpdump.

nsenter -t <PID> -n ip addr show

⚙️ Why It Works

By targeting the PID of the container’s main process, this command forces your shell to use the network namespace allocated to that specific unit. Everything you run afterward thinks it is inside the container, ignoring the host’s actual network state.

🚀 Pro-Tip: Alias this to something like ‘nenter-net’ because you will definitely forget the flags next time.

Linux Tips & Tricks | © ngelinux.com | 11/6/2026