Container Basics On Linux (Namespaces/Cgroups)

Stop your child processes from seeing files they shouldn’t

🧩 The Challenge

Setting up a custom container-like environment and realized your child processes can still list the entire host filesystem is a nightmare. I spent three hours hunting down why a process could see sensitive /etc files even after I thought I’d locked it down.

💡 The Fix

Use a mount namespace combined with pivot_root to actually change the root directory for your process, making the host system invisible. This is how the heavy hitters like Docker actually lock your app inside a container boundary.

unshare -m -p -f chroot /path/to/my/rootfs /bin/sh

⚙️ Why It Works

By combining the mount namespace with chroot, you’re preventing the process from escaping the directory tree. The mount namespace ensures that any changes to your mount points stay strictly private to that process and its children.

🚀 Pro-Tip: Always mount a fresh proc filesystem inside the new root or your tools like top and ps will show you the host’s process list anyway.

Linux Tips & Tricks | © ngelinux.com | 8/7/2026