What is Docker Namespaces?

Namespaces have been part of the Linux kernel since around 2002, with more functionality and namespace types introduced over time. Real container functionality was added to the Linux kernel in 2013, however. This is what makes namespaces useful and popular. Namespaces enable you to create an isolated environment in which the container only knows what it can see because it is only in a certain namespace. When you begin a container, Docker creates a set of namespaces for it, and each container has its own distinct set of namespaces.

What is Docker Namespaces?

Docker's namespaces are a powerful and fundamental concept that supports the platform's ability to segregate and distribute resources effectively. To understand the relevance of Docker's namespaces, let's go on a journey and compare it to the general practice of sharing resources across conventional processes. In other words, the main feature of namespaces is that they segregate processes from one another. When operating many services on a server, isolating each service and its accompanying activities reduces the impact of modifications and security problems.

Types of Namespaces

• Process ID (PID) namespace: A process ID (PID) namespace assigns a unique set of PIDs to processes that are not shared with other namespaces. PID 1 is allocated to the first process started in a new namespace, followed by child processes.
• Mount namespace: It has an independent set of mount points that are visible to the processes within it. This implies that you can mount and unmount filesystems in a mount namespace without changing the host filesystem.
• User namespace: A user namespace has its own set of user and group IDs, which can be given to processes. This means that a process can have root privilege in its user namespace but not in others.
• UNIX Time-Sharing (UTS) namespace: Processes on the same system might appear to have distinct host and domain names.

Understanding General Process-Sharing Resources

In a generic computing environment, processes share resources, which can lead to disputes and resource management difficulties.

Consider several processes executing on a host machine with no isolation. These programs may unintentionally interact with one another, resulting in resource congestion, security risks, and challenges in managing dependencies.

In this case, processes share the same namespace, resulting in a lack of separation and independence. Resource conflicts, such as two processes attempting to access the same memory location or a competing file access, can cause unstable and unexpected behavior.

How Do Docker Namespaces Work?

Step 1: Enabling User Namespaces

You can use the example below to learn how to set up a namespace in a Docker environment.

$ sudo adduser dockremapper

Step 2: Restart Docker

After utilizing the namespace in docker you need to restart the namespace in a docker environment.

$ sudo /etc/init.d/docker 

Step 3: Check the permission

Then you could notice that new docker containers couldn't get permission to the host computer /etc/.

$ rik@rik-desktop:/# rm /root/etc/hosts

Step 4: Check the file hierarchic

next, you need to check the permission and file hierarchy for the new docker setup. To disable the user namespaces for a given container, use the --userns=host parameter with the docker container create, run, or exec commands.

root@rik-desktop:/var/lib/docker/400000.400000# cd ../

Step 5: Get the new bash

Running the docker run command in the terminal results in the new bash, as seen by the presence of a new bash process in pids.

root@rik-desktop: # ps aux | grep bash

Step 6: Pick up the new IP of the container

Without using any of the docker commands, we can now enter the process using the namespaces command because we know it already has different namespaces.

root@rik-desktop-172-31-32-150 ~ # nsenter -t 36174 -n

Step 7: Get access to all the namespace

With the command center -t <target ip> -a, we may gain access to the whole namespace of that process. It is the same as the command docker attach <name>.

[root@rik-desktop-172-31-32-150 ~]# nsenter -t 36174 -a

Conclusion

In this article, we have learned about docker namespaces. Docker uses namespaces to create the container, which is an isolated workspace. When you launch a container, Docker generates a set of namespaces for it.