👉 Overview
👀 What ?
Namespaces are a feature of the Linux kernel that isolates and virtualizes system resources for a collection of processes. They provide a layer of abstraction that makes a group of processes and their children believe they have their own isolated instance of the global system resources.
🧐 Why ?
Namespaces are crucial because they provide a way to isolate processes, enabling system administrators to run applications in isolation, thereby mitigating potential security threats and ensuring system stability. They allow for a more efficient use of system resources and a reduction in potential conflicts between applications.
⛏️ How ?
To implement namespaces, one must utilize the 'unshare' or 'clone' commands provided by the Linux kernel. These commands create new namespaces, and processes can then be added to these namespaces, isolating them from the rest of the system. It's important to note that a process can be a part of multiple namespaces.
⏳ When ?
Namespaces have been a part of the Linux kernel since version 2.6.24, which was released in 2008.
⚙️ Technical Explanations
Namespaces are a fundamental component of the Linux kernel that aid in the compartmentalization and isolation of system resources for processes. They work by allowing the kernel to create separate instances, or 'namespaces', for different groups of processes.
When a process tries to access a system resource, the kernel doesn’t directly grant access. Instead, it redirects the process to the appropriate instance or 'namespace', hence the term 'namespace'. This mechanism ensures that each process can only see and affect the resources within its own namespace, thereby providing a layer of isolation and security.
There are several types of namespaces, each designed to isolate a specific type of system resource.
- PID namespaces: Isolate the process ID number space, meaning that processes in different PID namespaces can have the same PID.
- Network namespaces: Provide isolation of the network stack, meaning each namespace can have its own network devices, IP addresses, IP routing tables, port numbers, etc.
- Mount namespaces: Isolate the set of filesystem mount points seen by a group of processes. Processes in different mount namespaces can have different views of the filesystem hierarchy.
- User namespaces: Isolate the user and group ID number spaces. In other words, a process's user and group IDs can be different inside and outside a user namespace.
- IPC namespaces: Isolate certain interprocess communication (IPC) resources, meaning IPC objects can be shared between processes within the same namespace but are isolated from other namespaces.
- cgroup namespaces: Isolate the cgroup root directory view of a process. This means processes in different cgroup namespaces can have a different view of the cgroup hierarchy.
- Time namespaces: Isolate the system clock, enabling different processes to view the system time differently.
Each type of namespace provides a different level and type of isolation, allowing system administrators to customize the degree of isolation based on the specific needs of individual processes or applications.
Let's take a closer look at how to use network namespaces. Suppose we want to create an isolated network environment for a process. We can achieve this using the ip netns command, which is part of the iproute2 package that manages namespaces on Linux.
- Create a new namespace: We use the
addkeyword to create a new namespace. Let's call itnetns1.
sudo ip netns add netns1
- Verify the namespace: The
listkeyword shows all the namespaces.
sudo ip netns list
- Create a virtual network interface: We create a pair of
veth(virtual ethernet) interfaces. One end (veth1) stays in the global namespace, and the other end (veth1_peer) moves to the new namespace.
sudo ip link add veth1 type veth peer name veth1_peer
- Move
veth1_peertonetns1:
sudo ip link set veth1_peer netns netns1
- Bring up the interfaces: The
setkeyword changes the state of an interface. We'll bring up both ends of ourvethpair.
sudo ip link set veth1 up
sudo ip netns exec netns1 ip link set veth1_peer up
- Assign IP addresses: We'll assign IP addresses to both ends of the
vethpair.
sudo ip addr add 10.0.0.1/24 dev veth1
sudo ip netns exec netns1 ip addr add 10.0.0.2/24 dev veth1_peer
- Test the isolation: We can use the
pingcommand to test the network isolation. Processes in the global namespace should be able to ping10.0.0.2, but not vice versa, becausenetns1is isolated.
ping -c 3 10.0.0.2
sudo ip netns exec netns1 ping -c 3 10.0.0.1
This example illustrates how Linux namespaces work, allowing processes to operate in isolated environments, which is crucial for system security and process management.