Container Basics On Linux (Namespaces/Cgroups)
Stop your PID namespaces from letting child processes see the host
🧩 The Challenge
You ever spin up a simple container, run ps, and realize the process is still seeing every single thread running on your host machine? It makes troubleshooting look like staring into the abyss and it’s a security nightmare waiting to happen.
đź’ˇ The Fix
Use unshare to create a fresh process namespace so your containerized process thinks it’s the only one running on the system. It keeps your process tree clean and keeps the host metadata private.
sudo unshare --fork --pid --mount-proc ps aux⚙️ Why It Works
By re-mounting the proc filesystem inside the new namespace, you’re effectively hiding the host’s process table from whatever command you run next.
🚀 Pro-Tip: Always include the –fork flag when creating a new PID namespace or your shell won’t be PID 1 in the new sandbox.
Linux Tips & Tricks | © ngelinux.com | 7/30/2026