Container Basics On Linux (Namespaces/Cgroups)

Stop spinning up containers just to test network stuff

🧩 The Challenge

You just need to run one quick command, maybe curl something or ping a specific IP, but you need it to behave like it’s in a totally fresh, isolated network environment. Most folks reach for Docker or Podman for this, and honestly, firing up a whole container runtime just for a quick test feels like bringing a bazooka to a knife fight. I’ve wasted far too much time doing this before, waiting for containers to spin up and then doing the cleanup.

💡 The Fix

Linux offers `unshare`, a super handy command that lets you fork a process into its own new namespaces. You can get a completely isolated network stack for a single command, then it all just vanishes when the command finishes. And the best part? No container overhead, no messy cleanup, just pure network isolation for your one-off test.

unshare --net --mount --pid --fork sh -c '
echo "--- INSIDE NEW NAMESPACE ---"
echo "Initial network interfaces:"
ip a
echo ""
echo "Bringing up loopback..."
ip link set lo up
echo "Network interfaces after loopback:"
ip a
echo ""
echo "Testing internal connectivity:"
ping -c 2 127.0.0.1

echo "Trying to reach host network (should fail unless veth pair set up):"
ping -c 2 8.8.8.8 || echo "Ping failed as expected: no external network access yet."

echo "--- EXITING NEW NAMESPACE ---"
'

⚙️ Why It Works

The magic here is `unshare –net`. It tells the kernel to give your new `sh` process, and everything it runs, a brand new network namespace, completely detached from your host’s network stack. You’re starting with literally no interfaces configured, not even `lo`, which is why that first `ip a` looks so empty. Bringing `lo` up inside is the first step to making it a functional, albeit isolated, network world.

🚀 Pro-Tip: Try adding a `veth` pair to connect your isolated shell to the host network. You get isolation AND connectivity.

Linux Tips & Tricks | © ngelinux.com | 10/23/2026