Linux – View/manipulate mount namespaces in Linux

linuxmountnamespace

Is there any way to view or manipulate the mount namespace for an arbitrary process?

For example, a docker container is running which has a local mount to an NFS server. It can be seen from inside the container, but on the outside, the host has no knowledge of it. With network namespaces this is doable. e.g. pipework

However, I see nothing about this for mount namespaces. Is there an API or sysfs layer exposed to view these mounts and manipulate or create new ones?

Best Answer

Yes. You can look at its /proc/$PID/mountinfo or else you can use the findmnt -N switch - about which findmnt --help says:

  • -N, --task <tid>
    • use alternative namespace (/proc/<tid>/mountinfo file)

findmnt also tracks the PROPAGATION flag which is a mountinfo field which reports on exactly this information - which processes share which mounts.

Also, you can always nsenter any type of namespace you like - provided you have the correct permissions, of course.

 nsenter --help
Usage:
 nsenter [options] <program> [args...]

Options:
 -t, --target <pid>     target process to get namespaces from
 -m, --mount [=<file>]  enter mount namespace
 -u, --uts   [=<file>]  enter UTS namespace (hostname etc)
 -i, --ipc   [=<file>]  enter System V IPC namespace
 -n, --net   [=<file>]  enter network namespace
 -p, --pid   [=<file>]  enter pid namespace
 -U, --user  [=<file>]  enter user namespace
 -S, --setuid <uid>     set uid in user namespace
 -G, --setgid <gid>     set gid in user namespace
 -r, --root  [=<dir>]   set the root directory
 -w, --wd    [=<dir>]   set the working directory
 -F, --no-fork          do not fork before exec'ing <program>

 -h, --help     display this help and exit
 -V, --version  output version information and exit

For more details see nsenter(1).
Related Question