Container Basics On Linux (Namespaces/Cgroups)

Stop the invisible wall between your host and container processes

🧩 The Challenge

You’ve likely tried to poke at a process inside a container from your host, only to have ps show you absolutely nothing. It’s annoying as hell when you know the app is running but the kernel acts like it’s invisible to your standard monitoring tools.

💡 The Fix

Use nsenter to step into the container’s PID namespace so you can see the world from the perspective of the application. It saves you from having to install debugging tools inside your minimal container images.

PID=$(docker inspect --format {{.State.Pid}} <container_name_or_id>)
nsenter -t $PID -p -m ps aux

⚙️ Why It Works

By telling nsenter which PID namespace to join, you effectively break out of your host’s isolated view and inherit the process tree of the target container. And since you’re passing the -m flag too, you get to see their mount namespace, which makes inspecting local config files way easier.

🚀 Pro-Tip: Alias this to something like ‘nps’ because you’ll definitely be doing it more than once this week.

Linux Tips & Tricks | © ngelinux.com | 8/27/2026