Lesson 2.64: Containers are processes: namespaces
A container is not a small virtual machine. It's ordinary processes on the host that the kernel gives their own view of the network, the file system, the hostname and the process list (namespaces), inside their own cgroup. That's why ss on the host can miss a port a container listens on, while lsof and ps still see the process. In the lab a network sensor flagged port 4444 on Northwind's shop API host. You find the listener the host's ss can't see, step into the container's namespaces with nsenter, read its files through /proc, and freeze it for the investigators.
18 min
You will learn to
- Explain namespaces and how containers use them
- List namespaces with lsns and /proc/PID/ns
- Run a command inside a process's namespaces with nsenter
- Read a container's files through /proc/PID/root
- Freeze a container's cgroup to preserve it
Key terms
- Namespace
- A kernel feature that gives a group of processes its own view of one resource.
- Network namespace
- Its own interfaces, addresses, routes, firewall rules and sockets.
- Mount namespace
- Its own set of mounted file systems, so a container sees its image as /.
- lsns
- Lists namespaces with the number of processes in each and the first one's command.
- nsenter
- Runs a program inside the namespaces of another process.
- cgroup freezer
- cgroup.freeze stops every process in a group without killing it.
← Time sync and time zones · All lessons · Who really did it: attribution through sudo →