Questions tagged [namespaces]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

What makes nsjail's disable_no_new_privs dangerous?

The documentation of nsjail states that disable_no_new_privs is dangerous: --disable_no_new_privs Don't set the prctl(NO_NEW_PRIVS, 1) (DANGEROUS) The kernel docs point out that For example, the ...
lucidbrot's user avatar
  • 131
0 votes
1 answer
34 views

Plug in multiple devices with the exact same IP to one Linux host

I have a need to have multiple devices with same IP address connected to the same host. I am attaching a photo to demonstrate the topology So on the host side the IP is 192.168.19.1 and on the 3 ...
koby058's user avatar
0 votes
0 answers
99 views

Dovecot: doveadm sync namespace | single folder

I am trying to make sync (or sync -1) for single folder. Forwarding the manuals, we can use -x flag to exclude folders - it works fine. Also, there is -n flag to sync namespaces. As i see, there is no ...
user989840's user avatar
0 votes
0 answers
287 views

Resolve network name resolution inside a namespace

I have managed to set up a namespace. I was able to PING with the namespace. $ ip netns exec myNS ping 8.8.4.4 However, my PING is unsuccessful when I perform the following instruction: $ ip netns ...
kogepan's user avatar
0 votes
1 answer
208 views

How do CPUShares work across parent and children cgroups?

Redhat has a great blog post describing CPUShares, but it assumes processes reside in leaf CGroups, and doesn't discuss how CPU time is calculated for processes that reside in branch CGroups. For ...
Lawrence Wagerfield's user avatar
0 votes
1 answer
2k views

Docker: mapping container UID to an "non-existing" UID on host

I am tinkering with Linux namespaces to better understand how Docker (or rather, runc) interacts with them. By default, Docker does not create a user namespace for a container, meaning that UID 0 ...
Blizzard7469's user avatar
0 votes
1 answer
401 views

Is it possible to confine SSH users to a new mount namespace on Login?

Users logging into our shared servers over SSH currently always enter into the root mount namespace, which for example allows all users to see the same /var/tmp directory, making it a contended ...
JamesHannah's user avatar
  • 1,731
1 vote
1 answer
1k views

How to set a firewall between two network namespaces?

So i created a network namespace named client, and another namespace called server. I also create virtual ethernets to connect them. ip netns add client ip netns add server ip link add v-client type ...
talatt's user avatar
  • 11
1 vote
0 answers
470 views

Invalid argument received when running chown in a Linux namespace

After running something like this: unshare -rUm mkdir opt mount --bind opt /opt touch /opt/test chown 1000:1000 /opt/test I'm receiving this: chown: changing ownership of '/opt/test': Invalid ...
Marius's user avatar
  • 11
1 vote
1 answer
9k views

How to cleanup namespace in kubernetes?

We have one cluster in aks. Where we deployed consul helm chart in consul namespace. It created many CRDs. The using these CRDs internally created one more namespace applicationns When we deleted ...
user2331760's user avatar
4 votes
1 answer
998 views

Bind mount one container FS tree into another for debug or ephemeral containers?

I'm testing out k8s debugging features including debug pods and ephemeral containers, and I just can't work out how to properly map a "target" pod's file system into the debug container. I ...
Craig Ringer's user avatar
  • 11.2k
0 votes
1 answer
1k views

Force new process to use the specific network interface (using netns/network namespaces)

I have a number of interfaces available on Ubuntu 20.04 machine. Among others enx0c5b8f279a64 and usb0 with the later being used as the default one. I want to make sure that a particular process ...
Kira's user avatar
  • 11
0 votes
1 answer
1k views

Get resources across all namespaces by name - clusterrole vs all other resources

May be the wrong forum for such a question, but I am wondering why: k get daemonsets.apps sysdig-agent -A returns: error: a resource cannot be retrieved by name across all namespaces while k get ...
Dobhaweim's user avatar
11 votes
3 answers
15k views

Linux list all network namespaces

I want to list all the network namespaces on my Linux machine. So far I found two recommended ways to do this: ip netns list And lsns --type=net Unfortunately both commands do not list all the ...
Garuno's user avatar
  • 241
1 vote
1 answer
356 views

namespace - nobody to root mapping

I'd like to create new user namespace being root with the command: # unshare -U bash $ echo $$ 3500 $ id uid=65534(nobody) ... etc After that I edit /proc/3500/uid_map im my initial namespace as root:...
pawel__86's user avatar
-1 votes
1 answer
77 views

Build a multitenant managed control plane for kubernetes

I noticed that there are some cloud providers that offer a managed solution for kubernetes, I'm wondering what are the various components involved in this offering. My gut feeling is telling me there ...
Paco V.'s user avatar
1 vote
0 answers
79 views

Copy file from real home into DynamicUser home

I am working on restricting the permssions of user units in SystemD. One of the things that I want to do is set ProtectHome=yes (or DynamicUser=yes), but the process needs access to the .Xauthority ...
rhbvkleef's user avatar
  • 136
2 votes
1 answer
1k views

Alpine linux veth network/bridge has no internet

I have been trying to follow multiple guides to setup a veth-pair for 2 namespaces which can communicate with each other on alpine linux. So far I have communication between namespaces working but ...
D3181's user avatar
  • 123
0 votes
0 answers
1k views

Error: Connection activation failed: Failed to find a compatible device for this connection

Hi linux newbie here pardon any mistakes. I have configured a network namespace local-routeTable and have brought up interface eth3 inside the namespace: # ip netns exec local-routeTable ifconfig eth3:...
nguns's user avatar
  • 3
1 vote
1 answer
916 views

Disable mount namespaces in Apache/PHP-FPM

For a web GUI to manage NFS mount points, we've run into a problem after migrating to Centos 8. JS Billings noted that: CentOS8 runs httpd in a private namespace (with its own private /tmp). Since it'...
Danny's user avatar
  • 245
3 votes
1 answer
3k views

Run docker in an existing network namespace?

Would it be possible to run a docker container inside an existing namespace ? I created a namespace using: ip netns add client Now I want to run a container (with a bridge or host network, whatever is ...
SandiJ's user avatar
  • 41
2 votes
2 answers
830 views

Unable to reach network namespace through master

I'm trying to create an isolated lab using network namespaces. It works correctly, that is, only the machines in the network namespace can talk. But now I want reach the machines by localhost using v-...
Fabio's user avatar
  • 133
1 vote
1 answer
740 views

Dovecot: issue with converting mdbox to MailDir

I have a problem to convert mdbox to MailDir. Log from that process looks like: /bin/dsync -Dv -u [email protected] mirror maildir:/tmp/destination/mailboxes/[email protected] Debug: Loading modules ...
JackTheKnife's user avatar
0 votes
0 answers
1k views

Communicating across macvlan network namespaces

Let's create two macvlan's and attach network namespaces to them: $ sudo ip link add macvlan1 link eth0 type macvlan mode bridge $ sudo ip link add macvlan2 link eth0 type macvlan mode bridge $ sudo ...
adam-m-hanna's user avatar
1 vote
1 answer
61 views

Added DFSR to Domain controller, non domain admins can not create shares

My situation is I deployed a couple of domain controllers at some locations. My boss didn't want to spend money on servers, so I reused some servers we were not using. I installed them as domain ...
mild0d2's user avatar
  • 31
1 vote
1 answer
1k views

How to connect two networks having the same network address using a linux host which is part of both networks with the same IP address?

I have two cloned networks (lan1 and lan2) used for testing purposes, each with the same address space 10.20.80.0/22: # 10.20.80.0/22 10.20.80.0 # first address ... 10.20.83.254 # last address ...
Johannes Braunias's user avatar
1 vote
0 answers
318 views

Glusterfs support for user namespaces

I have a gluster volume mounted on a host machine and tried to run a namespaced docker container with a bind mount from the gluster mount on the host. It seems that the user namespacing is not ...
jojoob's user avatar
  • 194
1 vote
0 answers
498 views

Linux NFS (v4) user namespace file permissions

I am trying to set up a rootless container setup using podman and am having a problem with file permissions on NFS (running NFSv4). Within the user namespace, I am able to create files as root on any ...
Bruce's user avatar
  • 11
9 votes
1 answer
9k views

Cannot create nested network namespace

Is seems that one is not able to create a network namespace from a network namespace. It results in "Error: Peer netns reference is invalid.". Is this a bug or is there some kind of limitation that I ...
user98651's user avatar
  • 193
11 votes
6 answers
19k views

Do Containers Have An OS?

I know that containers use the host's kernel and from what I understand , that's the reason we do not need an OS. My questions are (and I couldn't find any good explanation online) : 1) If that's ...
John Doe's user avatar
  • 515
2 votes
1 answer
293 views

How to recover an SSD (Samsung) after deleting all the namespaces?

I deleted all the namespaces (2 were present) on a samsung drive (SSD). Now the drive is not being recognized by the system. How do I recover the SSD?
Kailash Mallikarjun's user avatar
4 votes
2 answers
11k views

How to run a command in another process's network namespace?

There is a process running in its own network namespace. I would like to telnet to the machine and run a command in this process network namespace, something like that (17543 is the pid of the process ...
wulujey's user avatar
  • 141
0 votes
1 answer
159 views

Kubernetes, partitioning around clusters and namespaces

Let's say we have 2 subsystems: A & B. And we have 2 env: QA & Prod. What would be a better way to organize it around cluster & namespace?. Is it: One cluster for subsystem A, another ...
Cokorda Raka's user avatar
9 votes
1 answer
11k views

How do I mount a private /proc inside a namespace inside a docker container?

I have a need to create namespaces inside a Docker container. And as part of this, I will need to mount a /proc private to the inner namespace. I realize that I will have to run the container with ...
Omnifarious's user avatar
3 votes
0 answers
3k views

bind mount /proc in Docker container with user namespaces enabled

My dockerd (CentOS7: 17.12.0-ce, build c97c6d6) is running with user namespaces enabled for better isolation. Now I build a image which is supposed to read for monitoring purposes also from /proc of ...
THX's user avatar
  • 243
1 vote
1 answer
318 views

Error deploying neo4j cluster on Kubernetes namespace

I am trying to install neo4j on kubernetes using Helm to a separate namespace and cluster startup is failing with the below error. But the same install into default namespace is working fine. Anyone ...
rvarghese's user avatar
5 votes
1 answer
2k views

Access another process's mount namespace

Is there a way to inspect the files and directories of another mount namespace? setns(2) syscall appears to be able to move a thread to another namespace, but if this functionality is not already ...
Gima's user avatar
  • 153
1 vote
1 answer
869 views

Docker namespaces and SELinux not working

My system: Debian 9 Stretch Docker version 17.06.0-ce, build 02c1d87 SELinux This is just running fine. But, if I also activate Namespace Remapping (default, using the dockremap User), I can't run ...
benth's user avatar
  • 11
-2 votes
1 answer
145 views

Domain without Nameservers- how to find them [duplicate]

I am a bit new to the servers. I still want to ask one question, and yes I know its a noob question but still... So I bought one domain from amazon AWS. The domain name is droni-bg.eu. Do you know how ...
strash's user avatar
  • 99
14 votes
2 answers
10k views

Chrome under Docker: CAP_SYS_ADMIN vs privileged? [closed]

I am running chromedriver + chrome inside Docker in my test environment. Everything was working fine until latest CoreOS upgrade. These are the versions that seem to work: VERSION=1185.5.0 ...
Jakov Sosic's user avatar
  • 5,267
3 votes
1 answer
365 views

Why LXC requires restart?

LXC documentation says: Just before you create your first container, you probably should logout and login again, or even reboot your machine to make sure that your user is placed in the right ...
Jacek L.'s user avatar
  • 131
2 votes
0 answers
407 views

Can systemd's .mount units be used to mount to points within a service's namespace only?

I am interested in setting a temporary directory that exists for the duration of the .service unit's running - exactly like the PrivateTmp= directive but on a custom mount point specified by a systemd ...
Benjamin's user avatar
  • 250
1 vote
0 answers
687 views

WebDav Performance - Drive mapping vs Web Browsing

I can't seem to find any information about this topic. We have setup an IIS server with WebDav support and this seems to be a fine solution but we're getting fairly slow performance out of a specific ...
Shadymilkman01's user avatar
0 votes
1 answer
102 views

Linking a domain name to a web server without full masking

I'm currently trying to deploy my first website and I ran trough a small issue with DNS. I have my website www folder available (hosted on atlantic.net cloud) and I registered a domain through godaddy....
jonnybravo's user avatar
-2 votes
2 answers
1k views

How to run a program in a new PID namespace

How to run a program in a new PID namespace? All tutorials on the internet show writing some custom C code in order to do it. Is there a command instead for that?
Ivan's user avatar
  • 179
1 vote
0 answers
705 views

Forward port to virtual IP in namespace

So, I followed this guide to make a namespace where I can run my VPN: https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/ It works fine so far, but I have one problem. I ...
a.j. tawleed's user avatar
0 votes
1 answer
3k views

publish DFS namespaces?

We have multiple domain controllers and file servers, and have recently begun migrating to DFS. Everything works quite well, but one thing has me scratching my head... DFS namespaces not found on ...
ltwally's user avatar
  • 325
1 vote
1 answer
1k views

dovecot namespace: empty prefix vs. list=yes

I just upgraded dovecot from 2.1.7 to 2.2.13, and my previously working configuration broke. I have one user with an empty prefix in his default namespace: Error: XXXX: Initialization failed: ...
Joachim Breitner's user avatar
15 votes
3 answers
30k views

How can I move an interface out of a network namespace?

If I move an interface temporarily into a netns with ip link set eth10 netns myns then it no longer is visible in the root, only within the namespace myns. How do I move it back, something like (...
deitch's user avatar
  • 585
2 votes
1 answer
3k views

Dovecot not working with added public namespace

we're running Dovecot 2.2.5 under OS X Server 4.1 (under 10.10.3). I'm trying to add a public namespace with some public folders without success. doveconf -n: # 2.2.5: /Library/Server/Mail/Config/...
jaydisc's user avatar
  • 489