Container Basics On Linux (Namespaces/Cgroups)

Stop your nested processes from leaking outside your namespace

🧩 The Challenge

Dealing with a container that needs to spin up child processes, only to find those orphans hanging around the host PID namespace even after the parent dies is a total headache. Nobody tells you that unless you explicitly configure the init process for that namespace, you’re going to end up with a mess of zombie processes cluttering your host’s view.

💡 The Fix

Using the unshare command with the mount and process namespace flags forces a new, isolated PID hierarchy where the container gets its own init process to clean up after itself. It keeps your host clean and stops the “where did these extra processes come from” guessing game.

sudo unshare --fork --pid --mount --mount-proc /bin/bash

⚙️ Why It Works

Adding the –mount-proc flag is the key step most people miss because it remounts /proc inside your new namespace so that ps actually sees the right PID map instead of the host’s. Without that, you’re just looking at a mirrored version of the host process list, which defeats the entire purpose of the isolation.

🚀 Pro-Tip: Run this inside a cgroup if you really want to lock down the resource limits alongside the visibility.

Linux Tips & Tricks | © ngelinux.com | 7/27/2026