Container Basics On Linux (Namespaces/Cgroups)

Verify Process Isolation via Namespace File Descriptors

🧩 The Challenge

It is difficult to confirm if two distinct processes are genuinely sharing the same kernel execution environment or are strictly isolated. You need a reliable way to check their namespace membership without external tools.

💡 The Fix

Inspect the inode numbers of the namespace virtual files associated with each process in the proc filesystem. If the inode values for a specific namespace type match, the processes share that isolation boundary.

ls -l /proc/[PID_A]/ns/net /proc/[PID_B]/ns/net

⚙️ Why It Works

The Linux kernel assigns a unique inode number to every namespace; matching inodes in the /proc namespace directory confirm the processes reside in the exact same kernel sandbox.

🚀 Pro-Tip: Use the readlink command on the namespace files to quickly compare them in a single line script for automated health checks.

Linux Tips & Tricks | © ngelinux.com | 7/10/2026