1NAMESPACES(7) Linux Programmer's Manual NAMESPACES(7)
2
6 namespaces - overview of Linux namespaces
7
9 A namespace wraps a global system resource in an abstraction that makes
10 it appear to the processes within the namespace that they have their
11 own isolated instance of the global resource. Changes to the global
12 resource are visible to other processes that are members of the name‐
13 space, but are invisible to other processes. One use of namespaces is
14 to implement containers.
15 This page provides pointers to information on the various namespace
17 types, describes the associated /proc files, and summarizes the APIs
18 for working with namespaces.
19 Namespace types
21 The following table shows the namespace types available on Linux. The
22 second column of the table shows the flag value that is used to specify
23 the namespace type in various APIs. The third column identifies the
24 manual page that provides details on the namespace type. The last col‐
25 umn is a summary of the resources that are isolated by the namespace
26 type.
27 Namespace Flag Page Isolates
29 Cgroup CLONE_NEWCGROUP cgroup_namespaces(7) Cgroup root
30 directory
31 IPC CLONE_NEWIPC ipc_namespaces(7) System V IPC, POSIX
32 message queues
33 Network CLONE_NEWNET network_namespaces(7) Network devices,
34 stacks, ports, etc.
35 Mount CLONE_NEWNS mount_namespaces(7) Mount points
36 PID CLONE_NEWPID pid_namespaces(7) Process IDs
37 Time CLONE_NEWTIME time_namespaces(7) Boot and monotonic
38 clocks
39 User CLONE_NEWUSER user_namespaces(7) T{User and group IDs
40 T}
41 UTS CLONE_NEWUTS uts_namespaces(7) Hostname and NIS
42 domain name
43 The namespaces API
45 As well as various /proc files described below, the namespaces API in‐
46 cludes the following system calls:
47 clone(2)
49 The clone(2) system call creates a new process. If the flags
50 argument of the call specifies one or more of the CLONE_NEW*
51 flags listed below, then new namespaces are created for each
52 flag, and the child process is made a member of those name‐
53 spaces. (This system call also implements a number of features
54 unrelated to namespaces.)
55 setns(2)
57 The setns(2) system call allows the calling process to join an
58 existing namespace. The namespace to join is specified via a
59 file descriptor that refers to one of the /proc/[pid]/ns files
60 described below.
61 unshare(2)
63 The unshare(2) system call moves the calling process to a new
64 namespace. If the flags argument of the call specifies one or
65 more of the CLONE_NEW* flags listed below, then new namespaces
66 are created for each flag, and the calling process is made a
67 member of those namespaces. (This system call also implements a
68 number of features unrelated to namespaces.)
69 ioctl(2)
71 Various ioctl(2) operations can be used to discover information
72 about namespaces. These