Container Basics On Linux (Namespaces/Cgroups)

Stop your process from seeing the host’s entire world

🧩 The Challenge

You ever tried to run a simple script and realized it can still poke around your host’s network and process list? It’s a total security headache that most people ignore until they see a breach.

💡 The Fix

Use unshare to carve out a private environment for your process without needing a full-blown container engine. It basically tells the kernel to hide the host’s namespaces from your command.

sudo unshare --fork --pid --mount-proc --net /bin/bash

⚙️ Why It Works

By combining these flags, the kernel essentially gives your bash session its own isolated view of the process table, network stack, and filesystem mounts, making the rest of the host invisible.

🚀 Pro-Tip: Check /proc/self/ns to verify you are actually in a different namespace than your shell.

Linux Tips & Tricks | © ngelinux.com | 7/27/2026