A Linux namespace is a kernel object that selects which instance of a kernel-managed resource set a thread uses. Mount namespaces select a mount tree; network namespaces select a network stack; PID namespaces select a process-ID hierarchy. Two processes can therefore use the same kernel while seeing different instances of one of those resources.
Linux creates an initial namespace of each supported type during boot. PID 1 belongs to those initial namespaces, and child processes inherit their parent’s namespace memberships unless a program requests different ones. A normal system therefore begins with one instance of each type; additional instances are created dynamically rather than reserved per user, process, or container.
Creating and joining namespaces
Three system calls change namespace membership. The flags select the namespace
type, such as CLONE_NEWNET for a network namespace or CLONE_NEWNS for a
mount namespace:
| System call | Namespace operation | Which thread runs in the new membership |
|---|---|---|
clone(..., CLONE_NEW*, ...) | Create a namespace and a child task inside it | The child |
unshare(CLONE_NEW*) | Create a namespace and detach from the caller’s current shared instance | The calling thread |
setns(fd, CLONE_NEW*) | Join the existing namespace referenced by fd | The calling thread |
setns receives a file descriptor rather than a numeric namespace ID. A
process exposes references to its memberships as files such as
/proc/1234/ns/net and /proc/1234/ns/mnt; opening one of those files produces
a descriptor that another process can pass to setns.
Namespace membership alone is not a container. A container runtime typically creates a child process in a chosen combination of mount, PID, user, network, IPC, UTS, cgroup, and time namespaces, then configures filesystems, credentials, cgroups, and other constraints around that process. Different containers may share a namespace deliberately. Kubernetes, for example, normally gives a Pod one network namespace shared by every container in the Pod.
Lifetime and names
A namespace remains alive while a process belongs to it or an open file descriptor or bind mount refers to it. The kernel destroys it after its last reference disappears. This permits a namespace to outlive the process that created it without making its lifetime global or permanent.
ip netns add NAME creates a network namespace and keeps a bind-mounted
reference under /run/netns/NAME. The name is an iproute2 convention, not a
kernel namespace name. Consequently, ip netns list shows namespaces with
those registered names, while lsns and /proc/*/ns/ can reveal unnamed
namespaces held by containers or other processes.
Network namespaces
A network namespace selects one instance of Linux networking state: interfaces, addresses, neighbour tables, routes, firewall rules, sockets, and port numbers. Every network device belongs to one network namespace at a time; veth pairs can connect devices placed in different namespaces. See Linux Networking for the contained objects and the commands that inspect or modify them.
On an otherwise unmodified host there is one network namespace: the initial
one. Container runtimes, Kubernetes Pods, VPN software, browser sandboxes, and
manual ip netns add commands can raise the count. The count is therefore a
property of the running system, not a Linux default per container.
Sources
namespaces(7)for namespace types, inheritance, system calls, references, and lifetime.network_namespaces(7)for the resources isolated by a network namespace and device membership.ip-netns(8)for named network namespaces under/run/netns.- Kubernetes Pods for the network namespace shared by a Pod’s containers.