Kernel namespaces for resource isolation

Namespaces create separate spaces for organizing and identifying software objects. This keeps them from affecting each other. As a result, each software object contains its own set of resources, for example, a mount point, a network device, or a hostname, even though they share the same system.

One of the most common technologies that use namespaces are containers.

Changes to a particular global resource are visible only to processes in that namespace and do not affect the rest of the system or other namespaces.

To inspect which namespaces a process is a member of, you can check the symbolic links in the /proc/<PID>/ns/ directory.

Table 1. Supported namespaces and resources which they isolate:
Namespace Isolates

Mount

Mount points

UTS

Hostname and NIS domain name

IPC

SysV IPC, POSIX message queues

PID

Process IDs

Network

Network devices, stacks, ports, and so on

User

User and group IDs

Control groups

Control group root directory

See namespaces(7) and cgroup_namespaces(7) man pages on your system for more information.