Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add overview.md to namespace #6

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions container-101/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
######################
.DS_Store
.DS_Store?
._*
4 changes: 4 additions & 0 deletions container-101/namespaces/index.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,10 @@
{
"title": "unshare",
"text": "unshare.md"
},
{
"title": "overview",
"text": "overview.md"
}
]
},
Expand Down
28 changes: 28 additions & 0 deletions container-101/namespaces/overview.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
"If host is a house, namespace is the room within the house assigned to each children providing privacy. Each child can only see inside their own room but not anything outside their room." -- KodeKloud (Youtuber)

What is namespace?
Namespace are used by container to implement network isolation.

Process ID(PID) namespace:
PID helps system tracks a specific task on the computer.
Ex. When you have safari and chrome searching on google for things, PID is used to identify where to direct the package sent back from google.
PID == 1 means it is the common ancestor to all the processes below.

Net namespace:
Network namespaces allow processes inside each namespace instance to have access to a new IP address along with the full range of ports.
Ex. Allowing us to run multiple versions of an email server listening on port 25 without any software conflicts.

UTS namespace:
Allows a single system to have different host and domain name to different processes.

User namespace:
Allows system to restrict access to sensitive files.
Ex. Not letting people using the same computer to access files that should not be seen by them.

Mount(mnt) namespace:
The mount namespace is used to isolate mount points such that processes in different namespaces cannot view each others' files.(just like chroot cmd)


RESOURCES:
1. https://www.youtube.com/watch?v=j_UUnlVC2Ss (Network Namespaces Basics Explained in 15 Minutes)(Youtube)
2. https://www.redhat.com/sysadmin/7-linux-namespaces (The 7 most used Linux namespaces)(Web)
52 changes: 50 additions & 2 deletions container-101/namespaces/unshare.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

input by normal user
```
unshare --user --map-root-user --pid --mount --fork
unshare --user --map-root-user --pid --mount --fork
```

```
Expand Down Expand Up @@ -35,4 +35,52 @@ lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 time -> 'time:[4026531834]'
lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:51 time_for_children -> 'time:[4026531834]'
lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 user -> 'user:[4026532478]'
lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 uts -> 'uts:[4026532304]'
```
```



Unshare is used to create new namespace
```
#sudo unshare -u
```

Shows your current hostname
```
#hostname
ubuntu
```

Change your current hostname
```
#hostname hello
#hostname
hello
```

But when you open a new tab, and check the host name
```
#hostname
ubuntu
```

To see the namespace of the current terminal
```
#ls /proc/$$/ns
cgroup ipc mnt net pid pid_for_children user uts
#readlink /proc/$$/ns/uts
uts:[4026532341]
```

But at the other terminal you opened
```
#readlink /proc/$$/ns/uts
uts:[4026531838]
```
The uts is different!
Meaning it is at different UTS namespace.
However, if we check the mount namespace, it is the same.
```
#readlink /proc/$$/ns/mnt
mnt:[4026531840]
```
This is because it is mounted on the same mount point. It is just separated under the point.