iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Linux namespaces give processes separate views of selected system resources. I find them useful for focused experiments and network separation, but they are not a complete virtual machine: each namespace isolates only particular resources, and networking between namespaces needs additional setup.
What are Linux namespaces?
A namespace changes what a process can see or access for a particular category of system resource. Linux supports namespaces for network, process IDs (PID), mounts, users, interprocess communication (IPC), host and domain names (UTS), cgroups, and time. A process can be placed in different namespaces for different resource types, so the result is selective isolation—not a separate kernel or a full virtual machine.
The namespaces(7) overview describes the namespace types and the resources they affect. In practice, I think of namespaces as building blocks: useful when I want a command or group of processes to have a different view of one part of the system, without assuming that everything else is isolated too.
Recommended Free Tools
What a network namespace changes
A network namespace has its own networking devices, IPv4 and IPv6 protocol stacks, routing tables, firewall rules, sockets, and related /proc and /sys views. That makes it useful for separating network experiments from the host’s network configuration. The feature depends on kernel support, including CONFIG_NET_NS; whether a particular operation is available also depends on privileges and system policy. See network_namespaces(7).
#1 Best Overall
How do I use Linux namespaces?
For a one-off task, unshare is the direct starting point: it creates the requested namespaces and runs a program in them. For example, this launches a shell in a new network namespace:
unshare --net shThe shell gets a separate network view, but the command alone does not configure a route to the internet or connect the namespace to the host. Network devices and connectivity must be arranged separately if the task needs them. Exact options and what an unprivileged user can do vary with the installed util-linux version, kernel configuration, distribution policy, and privileges. Check the local unshare(1) manual before adapting a command.
My practical distinction is simple: I use unshare when I want to create an isolated context for a command or shell. When the namespace already exists and I need to run something inside it, I use nsenter.
What does unshare do?
unshare starts a program with selected namespaces separated from the caller’s namespaces. Depending on the options supported by the installed version and the permissions available, it can create namespaces for resources such as networking, mounts, users, and process IDs. It does not automatically provide every kind of isolation, nor does creating a network namespace automatically provide network access.
Rank #3
Namespace lifetime is also part of the workflow. A namespace normally remains while it has member processes. Some namespaces can be kept alive after those processes exit by using bind mounts; a persistent PID namespace needs a running init process. The details and supported options are documented in unshare(1).
How do I enter a network namespace?
There are two common cases: entering a named network namespace managed with ip netns, or entering a namespace through a process that already belongs to it.
Enter a named namespace
List the named network namespaces with:
ip netns listThen run a command in one by name:
ip netns exec NAME commandReplace NAME with an entry shown by the list command and command with the program you want to run. The ip-netns(8) manual documents named namespace management. A namespace created for a one-off process with unshare is not necessarily registered as a named ip netns entry.
Enter namespaces associated with a process
nsenter runs a command or shell in namespaces that already exist, selected on the command line. For example, entering a target process’s network namespace uses its process ID:
nsenter --target PID --net commandSubstitute the target process ID and the command to run. The command’s manual describes entering selected mount, PID, user, cgroup, and time namespaces; it directs users to unshare when the task is to create new namespaces. See nsenter(1).
Connecting namespaces with a veth pair
A veth pair is a virtual link with two ends, much like a pipe between network namespaces: traffic sent through one end can reach the other. One end can be placed in one namespace and its peer in another. This creates a possible connection between their network stacks, not automatic internet access.
To provide broader connectivity, the surrounding network must also be configured appropriately. Routing, firewall rules, addressing, DNS, bridges, and possibly NAT depend on the intended setup; the existence of a veth pair alone establishes none of those. The kernel’s network namespace documentation describes the veth connection capability.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsChoosing the right namespace workflow
| Approach | Best suited to | Lifecycle and entry | Networking and trade-offs |
|---|---|---|---|
unshare |
A one-off command or shell that needs selected new namespaces. | Creates namespaces for the command; normal lifetime follows member processes. Persistence has additional requirements. | A new network namespace is isolated but not automatically connected. Manual primitives are flexible, while details vary by system. |
Named network namespace with ip netns |
Repeated management of network namespaces by name. | Named entries can be listed with ip netns list and commands can be run in them with ip netns exec. |
Useful when naming and reusing network contexts matters; connectivity still needs appropriate configuration. |
nsenter |
Running a command in namespaces that are already present, often those associated with a process. | Does not create the target namespace; select the target and namespace types when invoking it. | Good for entering an existing context, but does not replace the setup that created or connected it. |
These are complementary tools, not competing guarantees. I reach for unshare to create a short-lived context, named network namespaces when I want to manage network contexts by name, and nsenter when I need to join a namespace already in use. If the task calls for broader lifecycle management or a complete guest system, these primitives alone may not be the right level of abstraction.
Quick Recap
Limits and system differences to keep in mind
- Isolation is selective. A namespace only changes the view of resources covered by that namespace; it should not be treated by itself as a complete security boundary or a replacement for a virtual machine.
- Availability varies. Kernel configuration, user privileges, distribution policy, and versions of util-linux and iproute2 affect which operations work and how commands behave.
- Persistence is not automatic. A namespace can disappear when its lifetime conditions are no longer met. Persistent PID namespaces need a running init process.
- Network separation is not network connectivity. A veth pair can link namespace interfaces, but routes and any required firewall, DNS, bridge, or NAT configuration are separate work.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
