Linux Kernel – Namespaces Support

linuxlinux-kernelnamespace

I am wondering what exactly the “Namespaces support” feature in the Linux kernel means. I am using kernel 3.11.1 (the newest stable kernel at this time).

If I decide to disable it, will I notice any change on my system?

And in case somebody decides to make use of namespaces, is it enough to just compile NAMESPACES=Y in the kernel, or does he need userspace tools as well?

Best Answer

In a nutshell, namespaces provide a way to build a virtual Linux system inside a larger Linux system. This is different from running a virtual machine that runs as an unprivileged process: the virtual machine appears as a single process in the host, whereas processes running inside a namespace are still running on the host system.

A virtual system running inside a larger system is called a container. The idea of a container is that processes running inside the container believe that they are the only processes in the system. In particular, the root user inside the container does not have root privileges outside the container (note that this is only true in recent enough versions of the kernel).

Namespaces virtualize one feature at a time. Some examples of types of namespaces are:

  • User namespaces — this allows processes to behave as if they were running as different users inside and outside the namespace. In particular, processes running as UID 0 inside the namespace have superuser privileges only with respect to processes running in the same namespace.
    Since Linux kernel 3.8, unprivileged users can create user namespaces. This allows an ordinary user to make use of features that are reserved to root (such as changing routing tables or setting capabilities).
  • PID namespaces — processes inside a PID namespace cannot kill or trace processes outside that namespace.
  • Mount namespaces — this allows processes to have their own view of the filesystem. This view can be a partial view, allowing some pieces of the filesystem to be hidden and pieces to be recomposed so that directory trees appear in different places. Mount namespaces generalize the traditional Unix feature chroot, which allows processes to be restricted to a particular subtree.
  • Network namespaces — allow separation of networking resources (network devices) and thus enhance isolation of processes.

Namespaces rely on the kernel to provide isolation between namespaces. This is quite complicated to get right, so there may still be security bugs lying around. The risk of security bugs would be the primary reason not to enable the feature. Another reason not to enable it would be when you're making a small kernel for an embedded device. In a general-purpose kernel that you'd install on a typical server or workstation, namespaces should be enabled, like any other mature kernel feature.

There are still few applications that make use of namespaces. Here are a few:

  • LXC is well-established. It relies on cgroups to provide containers.
  • virt-sandbox is a more recent sandboxing project.
  • Recent versions of Chromium also use namespaces for sandboxing where available.
  • The uWSGI framework for clustered applications uses namespaces for improved sandboxing.

See the LWN article series by Michael Kerrisk for more information.

Related Question