Container Basics On Linux (Namespaces/Cgroups)

Stop wondering why your container processes can see into your host

🧩 The Challenge

Dealing with a container that sees way more than it should is a nightmare, especially when you think you’ve isolated a service only to find it peering into the host’s mount points. I’ve wasted a whole afternoon once trying to figure out why a security scan was flagging host paths inside a supposedly jailed process.

💡 The Fix

Use unshare to verify your namespace boundaries before you actually spin up your full stack. It lets you create a clean sandbox on the fly to see if your process is effectively blind to the host.

sudo unshare -m -p -f --mount-proc=/proc sh -c "ps aux"

⚙️ Why It Works

Passing that mount-proc flag to unshare is the key part because it remounts /proc to match the new PID namespace, which prevents the process from peeking at the host’s running tasks. Without it, you’re just running a lie of a container.

🚀 Pro-Tip: Use the -r flag with unshare to map your current user to root inside the new namespace, giving you the perks without the risk.

Linux Tips & Tricks | © ngelinux.com | 7/22/2026