1NSENTER(1)                       User Commands                      NSENTER(1)
2
3
4

NAME

6       nsenter - run program in different namespaces
7

SYNOPSIS

9       nsenter [options] [program [arguments]]
10

DESCRIPTION

12       The nsenter command executes program in the namespace(s) that are
13       specified in the command-line options (described below). If program is
14       not given, then "${SHELL}" is run (default: /bin/sh).
15
16       Enterable namespaces are:
17
18       mount namespace
19           Mounting and unmounting filesystems will not affect the rest of the
20           system, except for filesystems which are explicitly marked as
21           shared (with mount --make-shared; see /proc/self/mountinfo for the
22           shared flag). For further details, see mount_namespaces(7) and the
23           discussion of the CLONE_NEWNS flag in clone(2).
24
25       UTS namespace
26           Setting hostname or domainname will not affect the rest of the
27           system. For further details, see uts_namespaces(7).
28
29       IPC namespace
30           The process will have an independent namespace for POSIX message
31           queues as well as System V message queues, semaphore sets and
32           shared memory segments. For further details, see ipc_namespaces(7).
33
34       network namespace
35           The process will have independent IPv4 and IPv6 stacks, IP routing
36           tables, firewall rules, the /proc/net and /sys/class/net directory
37           trees, sockets, etc. For further details, see
38           network_namespaces(7).
39
40       PID namespace
41           Children will have a set of PID to process mappings separate from
42           the nsenter process. nsenter will fork by default if changing the
43           PID namespace, so that the new program and its children share the
44           same PID namespace and are visible to each other. If --no-fork is
45           used, the new program will be exec’ed without forking. For further
46           details, see pid_namespaces(7).
47
48       user namespace
49           The process will have a distinct set of UIDs, GIDs and
50           capabilities. For further details, see user_namespaces(7).
51
52       cgroup namespace
53           The process will have a virtualized view of /proc/self/cgroup, and
54           new cgroup mounts will be rooted at the namespace cgroup root. For
55           further details, see cgroup_namespaces(7).
56
57       time namespace
58           The process can have a distinct view of CLOCK_MONOTONIC and/or
59           CLOCK_BOOTTIME which can be changed using
60           /proc/self/timens_offsets. For further details, see
61           time_namespaces(7).
62

OPTIONS

64       Various of the options below that relate to namespaces take an optional
65       file argument. This should be one of the /proc/[pid]/ns/* files
66       described in namespaces(7), or the pathname of a bind mount that was
67       created on one of those files.
68
69       -a, --all
70           Enter all namespaces of the target process by the default
71           /proc/[pid]/ns/* namespace paths. The default paths to the target
72           process namespaces may be overwritten by namespace specific options
73           (e.g., --all --mount=[path]).
74
75           The user namespace will be ignored if the same as the caller’s
76           current user namespace. It prevents a caller that has dropped
77           capabilities from regaining those capabilities via a call to
78           setns(). See setns(2) for more details.
79
80       -t, --target PID
81           Specify a target process to get contexts from. The paths to the
82           contexts specified by pid are:
83
84           /proc/pid/ns/mnt
85               the mount namespace
86
87           /proc/pid/ns/uts
88               the UTS namespace
89
90           /proc/pid/ns/ipc
91               the IPC namespace
92
93           /proc/pid/ns/net
94               the network namespace
95
96           /proc/pid/ns/pid
97               the PID namespace
98
99           /proc/pid/ns/user
100               the user namespace
101
102           /proc/pid/ns/cgroup
103               the cgroup namespace
104
105           /proc/pid/ns/time
106               the time namespace
107
108           /proc/pid/root
109               the root directory
110
111           /proc/pid/cwd
112               the working directory respectively
113
114       -m, --mount[=file]
115           Enter the mount namespace. If no file is specified, enter the mount
116           namespace of the target process. If file is specified, enter the
117           mount namespace specified by file.
118
119       -u, --uts[=file]
120           Enter the UTS namespace. If no file is specified, enter the UTS
121           namespace of the target process. If file is specified, enter the
122           UTS namespace specified by file.
123
124       -i, --ipc[=file]
125           Enter the IPC namespace. If no file is specified, enter the IPC
126           namespace of the target process. If file is specified, enter the
127           IPC namespace specified by file.
128
129       -n, --net[=file]
130           Enter the network namespace. If no file is specified, enter the
131           network namespace of the target process. If file is specified,
132           enter the network namespace specified by file.
133
134       -p, --pid[=file]
135           Enter the PID namespace. If no file is specified, enter the PID
136           namespace of the target process. If file is specified, enter the
137           PID namespace specified by file.
138
139       -U, --user[=file]
140           Enter the user namespace. If no file is specified, enter the user
141           namespace of the target process. If file is specified, enter the
142           user namespace specified by file. See also the --setuid and
143           --setgid options.
144
145       -C, --cgroup[=file]
146           Enter the cgroup namespace. If no file is specified, enter the
147           cgroup namespace of the target process. If file is specified, enter
148           the cgroup namespace specified by file.
149
150       -T, --time[=file]
151           Enter the time namespace. If no file is specified, enter the time
152           namespace of the target process. If file is specified, enter the
153           time namespace specified by file.
154
155       -G, --setgid gid
156           Set the group ID which will be used in the entered namespace and
157           drop supplementary groups. nsenter always sets GID for user
158           namespaces, the default is 0. If the argument "follow" is specified
159           the GID of the target process is used.
160
161       -S, --setuid uid
162           Set the user ID which will be used in the entered namespace.
163           nsenter always sets UID for user namespaces, the default is 0. If
164           the argument "follow" is specified the UID of the target process is
165           used.
166
167       --preserve-credentials
168           Don’t modify UID and GID when enter user namespace. The default is
169           to drops supplementary groups and sets GID and UID to 0.
170
171       -r, --root[=directory]
172           Set the root directory. If no directory is specified, set the root
173           directory to the root directory of the target process. If directory
174           is specified, set the root directory to the specified directory.
175           The specified directory is open before it switches to the requested
176           namespaces.
177
178       -w, --wd[=directory]
179           Set the working directory. If no directory is specified, set the
180           working directory to the working directory of the target process.
181           If directory is specified, set the working directory to the
182           specified directory. The specified directory is open before it
183           switches to the requested namespaces, it means the specified
184           directory works as "tunnel" to the current namespace. See also
185           --wdns.
186
187       -W, --wdns[=directory]
188           Set the working directory. The directory is open after switch to
189           the requested namespaces and after chroot(2) call. The options --wd
190           and --wdns are mutually exclusive.
191
192       -e, --env
193           Pass environment variables from the target process to the new
194           process being created. If this option is not provided, the
195           environment variables will remain the same as in the current
196           namespace..
197
198       -F, --no-fork
199           Do not fork before exec’ing the specified program. By default, when
200           entering a PID namespace, nsenter calls fork before calling exec so
201           that any children will also be in the newly entered PID namespace.
202
203       -Z, --follow-context
204           Set the SELinux security context used for executing a new process
205           according to already running process specified by --target PID.
206           (The util-linux has to be compiled with SELinux support otherwise
207           the option is unavailable.)
208
209       -h, --help
210           Display help text and exit.
211
212       -V, --version
213           Print version and exit.
214

AUTHORS

216       Eric Biederman <biederm@xmission.com>, Karel Zak <kzak@redhat.com>
217

SEE ALSO

219       clone(2), setns(2), namespaces(7)
220

REPORTING BUGS

222       For bug reports, use the issue tracker at
223       https://github.com/util-linux/util-linux/issues.
224

AVAILABILITY

226       The nsenter command is part of the util-linux package which can be
227       downloaded from Linux Kernel Archive
228       <https://www.kernel.org/pub/linux/utils/util-linux/>.
229
230
231
232util-linux 2.39.2                 2023-08-17                        NSENTER(1)
Impressum