Container Basics On Linux (Namespaces/Cgroups)

Stop your PID namespaces from letting child processes see the host

🧩 The Challenge

You ever spin up a simple container, run ps, and realize the process is still seeing every single thread running on your host machine? It makes troubleshooting look like staring into the abyss and it’s a security nightmare waiting to happen.

💡 The Fix

Use unshare to create a fresh process namespace so your containerized process thinks it’s the only one running on the system. It keeps your process tree clean and keeps the host metadata private.

sudo unshare --fork --pid --mount-proc ps aux

⚙️ Why It Works

By re-mounting the proc filesystem inside the new namespace, you’re effectively hiding the host’s process table from whatever command you run next.

🚀 Pro-Tip: Always include the –fork flag when creating a new PID namespace or your shell won’t be PID 1 in the new sandbox.

Linux Tips & Tricks | © ngelinux.com | 7/30/2026