Questions tagged [namespaces]
The namespaces tag has no usage guidance.
75
questions
0
votes
1
answer
45
views
What makes nsjail's disable_no_new_privs dangerous?
The documentation of nsjail states that disable_no_new_privs is dangerous:
--disable_no_new_privs
Don't set the prctl(NO_NEW_PRIVS, 1) (DANGEROUS)
The kernel docs point out that
For example, the ...
- 131
0
votes
1
answer
34
views
Plug in multiple devices with the exact same IP to one Linux host
I have a need to have multiple devices with same IP address connected to the same host.
I am attaching a photo to demonstrate the topology
So on the host side the IP is 192.168.19.1 and on the 3 ...
- 1
0
votes
0
answers
99
views
Dovecot: doveadm sync namespace | single folder
I am trying to make sync (or sync -1) for single folder.
Forwarding the manuals, we can use -x flag to exclude folders - it works fine.
Also, there is -n flag to sync namespaces. As i see, there is no ...
0
votes
0
answers
287
views
Resolve network name resolution inside a namespace
I have managed to set up a namespace.
I was able to PING with the namespace.
$ ip netns exec myNS ping 8.8.4.4
However, my PING is unsuccessful when I perform the following instruction:
$ ip netns ...
- 1
0
votes
1
answer
208
views
How do CPUShares work across parent and children cgroups?
Redhat has a great blog post describing CPUShares, but it assumes processes reside in leaf CGroups, and doesn't discuss how CPU time is calculated for processes that reside in branch CGroups.
For ...
0
votes
1
answer
2k
views
Docker: mapping container UID to an "non-existing" UID on host
I am tinkering with Linux namespaces to better understand how Docker (or rather, runc) interacts with them.
By default, Docker does not create a user namespace for a container, meaning that UID 0 ...
0
votes
1
answer
401
views
Is it possible to confine SSH users to a new mount namespace on Login?
Users logging into our shared servers over SSH currently always enter into the root mount namespace, which for example allows all users to see the same /var/tmp directory, making it a contended ...
- 1,731
1
vote
1
answer
1k
views
How to set a firewall between two network namespaces?
So i created a network namespace named client, and another namespace called server. I also create virtual ethernets to connect them.
ip netns add client
ip netns add server
ip link add v-client type ...
- 11
1
vote
0
answers
470
views
Invalid argument received when running chown in a Linux namespace
After running something like this:
unshare -rUm
mkdir opt
mount --bind opt /opt
touch /opt/test
chown 1000:1000 /opt/test
I'm receiving this:
chown: changing ownership of '/opt/test': Invalid ...
- 11
1
vote
1
answer
9k
views
How to cleanup namespace in kubernetes?
We have one cluster in aks.
Where we deployed consul helm chart in consul namespace.
It created many CRDs.
The using these CRDs internally created one more namespace applicationns
When we deleted ...
- 155
4
votes
1
answer
998
views
Bind mount one container FS tree into another for debug or ephemeral containers?
I'm testing out k8s debugging features including debug pods and ephemeral containers, and I just can't work out how to properly map a "target" pod's file system into the debug container.
I ...
- 11.2k
0
votes
1
answer
1k
views
Force new process to use the specific network interface (using netns/network namespaces)
I have a number of interfaces available on Ubuntu 20.04 machine. Among others enx0c5b8f279a64 and usb0 with the later being used as the default one. I want to make sure that a particular process ...
- 11
0
votes
1
answer
1k
views
Get resources across all namespaces by name - clusterrole vs all other resources
May be the wrong forum for such a question, but I am wondering why:
k get daemonsets.apps sysdig-agent -A
returns:
error: a resource cannot be retrieved by name across all namespaces
while
k get ...
11
votes
3
answers
15k
views
Linux list all network namespaces
I want to list all the network namespaces on my Linux machine. So far I found two recommended ways to do this:
ip netns list
And
lsns --type=net
Unfortunately both commands do not list all the ...
- 241
1
vote
1
answer
356
views
namespace - nobody to root mapping
I'd like to create new user namespace being root with the command:
# unshare -U bash
$ echo $$
3500
$ id
uid=65534(nobody) ... etc
After that I edit /proc/3500/uid_map im my initial namespace as root:...
- 11
-1
votes
1
answer
77
views
Build a multitenant managed control plane for kubernetes
I noticed that there are some cloud providers that offer a managed solution for kubernetes, I'm wondering what are the various components involved in this offering.
My gut feeling is telling me there ...
- 3
1
vote
0
answers
79
views
Copy file from real home into DynamicUser home
I am working on restricting the permssions of user units in SystemD. One of the things that I want to do is set ProtectHome=yes (or DynamicUser=yes), but the process needs access to the .Xauthority ...
- 136
2
votes
1
answer
1k
views
Alpine linux veth network/bridge has no internet
I have been trying to follow multiple guides to setup a veth-pair for 2 namespaces which can communicate with each other on alpine linux. So far I have communication between namespaces working but ...
- 123
0
votes
0
answers
1k
views
Error: Connection activation failed: Failed to find a compatible device for this connection
Hi linux newbie here pardon any mistakes.
I have configured a network namespace local-routeTable and have brought up interface eth3 inside the namespace:
# ip netns exec local-routeTable ifconfig
eth3:...
- 3
1
vote
1
answer
916
views
Disable mount namespaces in Apache/PHP-FPM
For a web GUI to manage NFS mount points, we've run into a problem after migrating to Centos 8.
JS Billings noted that:
CentOS8 runs httpd in a private namespace (with its own private /tmp).
Since it'...
- 245
3
votes
1
answer
3k
views
Run docker in an existing network namespace?
Would it be possible to run a docker container inside an existing namespace ?
I created a namespace using:
ip netns add client
Now I want to run a container (with a bridge or host network, whatever is ...
- 41
2
votes
2
answers
830
views
Unable to reach network namespace through master
I'm trying to create an isolated lab using network namespaces.
It works correctly, that is, only the machines in the network namespace can talk.
But now I want reach the machines by localhost using v-...
- 133
1
vote
1
answer
740
views
Dovecot: issue with converting mdbox to MailDir
I have a problem to convert mdbox to MailDir. Log from that process looks like:
/bin/dsync -Dv -u [email protected] mirror maildir:/tmp/destination/mailboxes/[email protected]
Debug: Loading modules ...
- 371
0
votes
0
answers
1k
views
Communicating across macvlan network namespaces
Let's create two macvlan's and attach network namespaces to them:
$ sudo ip link add macvlan1 link eth0 type macvlan mode bridge
$ sudo ip link add macvlan2 link eth0 type macvlan mode bridge
$ sudo ...
- 113
1
vote
1
answer
61
views
Added DFSR to Domain controller, non domain admins can not create shares
My situation is I deployed a couple of domain controllers at some locations. My boss didn't want to spend money on servers, so I reused some servers we were not using.
I installed them as domain ...
- 31
1
vote
1
answer
1k
views
How to connect two networks having the same network address using a linux host which is part of both networks with the same IP address?
I have two cloned networks (lan1 and lan2) used for testing purposes, each with the same address space 10.20.80.0/22:
# 10.20.80.0/22
10.20.80.0 # first address
...
10.20.83.254 # last address
...
1
vote
0
answers
318
views
Glusterfs support for user namespaces
I have a gluster volume mounted on a host machine and tried to run a namespaced docker container with a bind mount from the gluster mount on the host.
It seems that the user namespacing is not ...
- 194
1
vote
0
answers
498
views
Linux NFS (v4) user namespace file permissions
I am trying to set up a rootless container setup using podman and am having a problem with file permissions on NFS (running NFSv4).
Within the user namespace, I am able to create files as root on any ...
- 11
9
votes
1
answer
9k
views
Cannot create nested network namespace
Is seems that one is not able to create a network namespace from a network namespace. It results in "Error: Peer netns reference is invalid.".
Is this a bug or is there some kind of limitation that I ...
- 193
11
votes
6
answers
19k
views
Do Containers Have An OS?
I know that containers use the host's kernel and from what I understand , that's the reason we do not need an OS.
My questions are (and I couldn't find any good explanation online) :
1) If that's ...
- 515
2
votes
1
answer
293
views
How to recover an SSD (Samsung) after deleting all the namespaces?
I deleted all the namespaces (2 were present) on a samsung drive (SSD). Now the drive is not being recognized by the system. How do I recover the SSD?
4
votes
2
answers
11k
views
How to run a command in another process's network namespace?
There is a process running in its own network namespace. I would like to telnet to the machine and run a command in this process network namespace, something like that (17543 is the pid of the process ...
- 141
0
votes
1
answer
159
views
Kubernetes, partitioning around clusters and namespaces
Let's say we have 2 subsystems: A & B.
And we have 2 env: QA & Prod.
What would be a better way to organize it around cluster & namespace?. Is it:
One cluster for subsystem A, another ...
- 101
9
votes
1
answer
11k
views
How do I mount a private /proc inside a namespace inside a docker container?
I have a need to create namespaces inside a Docker container. And as part of this, I will need to mount a /proc private to the inner namespace. I realize that I will have to run the container with ...
- 400
3
votes
0
answers
3k
views
bind mount /proc in Docker container with user namespaces enabled
My dockerd (CentOS7: 17.12.0-ce, build c97c6d6) is running with user namespaces enabled for better isolation.
Now I build a image which is supposed to read for monitoring purposes also from /proc of ...
- 243
1
vote
1
answer
318
views
Error deploying neo4j cluster on Kubernetes namespace
I am trying to install neo4j on kubernetes using Helm to a separate namespace and cluster startup is failing with the below error. But the same install into default namespace is working fine. Anyone ...
- 21
5
votes
1
answer
2k
views
Access another process's mount namespace
Is there a way to inspect the files and directories of another mount namespace?
setns(2) syscall appears to be able to move a thread to another namespace, but if this functionality is not already ...
- 153
1
vote
1
answer
869
views
Docker namespaces and SELinux not working
My system:
Debian 9 Stretch
Docker version 17.06.0-ce, build 02c1d87
SELinux
This is just running fine.
But, if I also activate Namespace Remapping (default, using the dockremap User), I can't run ...
- 11
-2
votes
1
answer
145
views
Domain without Nameservers- how to find them [duplicate]
I am a bit new to the servers. I still want to ask one question, and yes I know its a noob question but still... So I bought one domain from amazon AWS. The domain name is droni-bg.eu. Do you know how ...
- 99
14
votes
2
answers
10k
views
Chrome under Docker: CAP_SYS_ADMIN vs privileged? [closed]
I am running chromedriver + chrome inside Docker in my test environment.
Everything was working fine until latest CoreOS upgrade.
These are the versions that seem to work:
VERSION=1185.5.0
...
- 5,267
3
votes
1
answer
365
views
Why LXC requires restart?
LXC documentation says:
Just before you create your first container, you probably should logout and login again,
or even reboot your machine to make sure that your user is placed in the right ...
- 131
2
votes
0
answers
407
views
Can systemd's .mount units be used to mount to points within a service's namespace only?
I am interested in setting a temporary directory that exists for the duration of the .service unit's running - exactly like the PrivateTmp= directive but on a custom mount point specified by a systemd ...
- 250
1
vote
0
answers
687
views
WebDav Performance - Drive mapping vs Web Browsing
I can't seem to find any information about this topic. We have setup an IIS server with WebDav support and this seems to be a fine solution but we're getting fairly slow performance out of a specific ...
- 113
0
votes
1
answer
102
views
Linking a domain name to a web server without full masking
I'm currently trying to deploy my first website and I ran trough a small issue with DNS. I have my website www folder available (hosted on atlantic.net cloud) and I registered a domain through godaddy....
-2
votes
2
answers
1k
views
How to run a program in a new PID namespace
How to run a program in a new PID namespace? All tutorials on the internet show writing some custom C code in order to do it. Is there a command instead for that?
- 179
1
vote
0
answers
705
views
Forward port to virtual IP in namespace
So, I followed this guide to make a namespace where I can run my VPN:
https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/
It works fine so far, but I have one problem. I ...
- 111
0
votes
1
answer
3k
views
publish DFS namespaces?
We have multiple domain controllers and file servers, and have recently begun migrating to DFS. Everything works quite well, but one thing has me scratching my head... DFS namespaces not found on ...
- 325
1
vote
1
answer
1k
views
dovecot namespace: empty prefix vs. list=yes
I just upgraded dovecot from 2.1.7 to 2.2.13, and my previously working configuration broke.
I have one user with an empty prefix in his default namespace:
Error: XXXX: Initialization failed: ...
- 3,839
15
votes
3
answers
30k
views
How can I move an interface out of a network namespace?
If I move an interface temporarily into a netns with
ip link set eth10 netns myns
then it no longer is visible in the root, only within the namespace myns.
How do I move it back, something like (...
- 585
2
votes
1
answer
3k
views
Dovecot not working with added public namespace
we're running Dovecot 2.2.5 under OS X Server 4.1 (under 10.10.3). I'm trying to add a public namespace with some public folders without success.
doveconf -n:
# 2.2.5: /Library/Server/Mail/Config/...
- 489