1NSENTER(1)                       User Commands                      NSENTER(1)
2
3
4

NAME

6       nsenter - run program in different namespaces
7

SYNOPSIS

9       nsenter [options] [program [arguments]]
10

DESCRIPTION

12       The nsenter command executes program in the namespace(s) that are
13       specified in the command-line options (described below). If program is
14       not given, then "${SHELL}" is run (default: /bin/sh).
15
16       Enterable namespaces are:
17
18       mount namespace
19           Mounting and unmounting filesystems will not affect the rest of the
20           system, except for filesystems which are explicitly marked as
21           shared (with mount --make-shared; see /proc/self/mountinfo for the
22           shared flag). For further details, see mount_namespaces(7) and the
23           discussion of the CLONE_NEWNS flag in clone(2).
24
25       UTS namespace
26           Setting hostname or domainname will not affect the rest of the
27           system. For further details, see uts_namespaces(7).
28
29       IPC namespace
30           The process will have an independent namespace for POSIX message
31           queues as well as System V message queues, semaphore sets and
32           shared memory segments. For further details, see ipc_namespaces(7).
33
34       network namespace
35           The process will have independent IPv4 and IPv6 stacks, IP routing
36           tables, firewall rules, the /proc/net and /sys/class/net directory
37           trees, sockets, etc. For further details, see
38           network_namespaces(7).
39
40       PID namespace
41           Children will have a set of PID to process mappings separate from
42           the nsenter process. nsenter will fork by default if changing the
43           PID namespace, so that the new program and its children share the
44           same PID namespace and are visible to each other. If --no-fork is
45           used, the new program will be exec’ed without forking. For further
46           details, see pid_namespaces(7).
47
48       user namespace
49           The process will have a distinct set of UIDs, GIDs and
50           capabilities. For further details, see user_namespaces(7).
51
52       cgroup namespace
53           The process will have a virtualized view of /proc/self/cgroup, and
54           new cgroup mounts will be rooted at the namespace cgroup root. For
55           further details, see cgroup_namespaces(7).
56
57       time namespace
58           The process can have a distinct view of CLOCK_MONOTONIC and/or
59           CLOCK_BOOTTIME which can be changed using
60           /proc/self/timens_offsets. For further details, see
61           time_namespaces(7).
62

OPTIONS

64       Various of the options below that relate to namespaces take an optional
65       file argument. This should be one of the /proc/[pid]/ns/* files
66       described in namespaces(7), or the pathname of a bind mount that was
67       created on one of those files.
68
69       -a, --all
70           Enter all namespaces of the target process by the default
71           /proc/[pid]/ns/* namespace paths. The default paths to the target
72           process namespaces may be overwritten by namespace specific options
73           (e.g., --all --mount=[path]).
74
75           The user namespace will be ignored if the same as the caller’s
76           current user namespace. It prevents a caller that has dropped
77           capabilities from regaining those capabilities via a call to
78           setns(). See setns(2) for more details.
79
80       -t, --target PID
81           Specify a target process to get contexts from. The paths to the
82           contexts specified by pid are:
83
84           /proc/pid/ns/mnt
85               the mount namespace
86
87           /proc/pid/ns/uts
88               the UTS namespace
89
90           /proc/pid/ns/ipc
91               the IPC namespace
92
93           /proc/pid/ns/net
94               the network namespace
95
96           /proc/pid/ns/pid
97               the PID namespace
98
99           /proc/pid/ns/user
100               the user namespace
101
102           /proc/pid/ns/cgroup
103               the cgroup namespace
104
105           /proc/pid/ns/time
106               the time namespace
107
108           /proc/pid/root
109               the root directory
110
111           /proc/pid/cwd
112               the working directory respectively
113
114       -m, --mount[=file]
115           Enter the mount namespace. If no file is specified, enter the mount
116           namespace of the target process. If file is specified, enter the
117           mount namespace specified by file.
118
119       -u, --uts[=file]
120           Enter the UTS namespace. If no file is specified, enter the UTS
121           namespace of the target process. If file is specified, enter the
122           UTS namespace specified by file.
123
124       -i, --ipc[=file]
125           Enter the IPC namespace. If no file is specified, enter the IPC
126           namespace of the target process. If file is specified, enter the
127           IPC namespace specified by file.
128
129       -n, --net[=file]
130           Enter the network namespace. If no file is specified, enter the
131           network namespace of the target process. If file is specified,
132           enter the network namespace specified by file.
133
134       -p, --pid[=file]
135           Enter the PID namespace. If no file is specified, enter the PID
136           namespace of the target process. If file is specified, enter the
137           PID namespace specified by file.
138
139       -U, --user[=file]
140           Enter the user namespace. If no file is specified, enter the user
141           namespace of the target process. If file is specified, enter the
142           user namespace specified by file. See also the --setuid and
143           --setgid options.
144
145       -C, --cgroup[=file]
146           Enter the cgroup namespace. If no file is specified, enter the
147           cgroup namespace of the target process. If file is specified, enter
148           the cgroup namespace specified by file.
149
150       -T, --time[=file]
151           Enter the time namespace. If no file is specified, enter the time
152           namespace of the target process. If file is specified, enter the
153           time namespace specified by file.
154
155       -G, --setgid gid
156           Set the group ID which will be used in the entered namespace and
157           drop supplementary groups. nsenter always sets GID for user
158           namespaces, the default is 0.
159
160       -S, --setuid uid
161           Set the user ID which will be used in the entered namespace.
162           nsenter always sets UID for user namespaces, the default is 0.
163
164       --preserve-credentials
165           Don’t modify UID and GID when enter user namespace. The default is
166           to drops supplementary groups and sets GID and UID to 0.
167
168       -r, --root[=directory]
169           Set the root directory. If no directory is specified, set the root
170           directory to the root directory of the target process. If directory
171           is specified, set the root directory to the specified directory.
172           The specified directory is open before it switches to the requested
173           namespaces.
174
175       -w, --wd[=directory]
176           Set the working directory. If no directory is specified, set the
177           working directory to the working directory of the target process.
178           If directory is specified, set the working directory to the
179           specified directory. The specified directory is open before it
180           switches to the requested namespaces, it means the specified
181           directory works as "tunnel" to the current namespace. See also
182           --wdns.
183
184       -W, --wdns[=directory]
185           Set the working directory. The directory is open after switch to
186           the requested namespaces and after chroot(2) call. The options --wd
187           and --wdns are mutually exclusive.
188
189       -F, --no-fork
190           Do not fork before exec’ing the specified program. By default, when
191           entering a PID namespace, nsenter calls fork before calling exec so
192           that any children will also be in the newly entered PID namespace.
193
194       -Z, --follow-context
195           Set the SELinux security context used for executing a new process
196           according to already running process specified by --target PID.
197           (The util-linux has to be compiled with SELinux support otherwise
198           the option is unavailable.)
199
200       -h, --help
201           Display help text and exit.
202
203       -V, --version
204           Print version and exit.
205

AUTHORS

207       Eric Biederman <biederm@xmission.com>, Karel Zak <kzak@redhat.com>
208

SEE ALSO

210       clone(2), setns(2), namespaces(7)
211

REPORTING BUGS

213       For bug reports, use the issue tracker at
214       https://github.com/util-linux/util-linux/issues.
215

AVAILABILITY

217       The nsenter command is part of the util-linux package which can be
218       downloaded from Linux Kernel Archive
219       <https://www.kernel.org/pub/linux/utils/util-linux/>.
220
221
222
223util-linux 2.38.1                 2022-05-11                        NSENTER(1)
Impressum