In this lesson, you will learn how Mount Namespaces act as a "security gatekeeper" for the files and folders a process can see on your host machine.
The Illusion of Isolation
In our previous lessons, we learned how namespaces allow a process to believe it is the only one running on a system (PID namespaces) or the only one managing network interfaces (Network namespaces). Mount namespaces extend this by isolating the file system mount points.
Without this, every process on your computer would see the exact same root directory (/) as your host machine. This is a security nightmare! If a containerized application could see your host’s system files, it could inadvertently (or maliciously) delete or modify files outside of its own environment.
Changing the View
When we launch a container, the kernel uses a mount namespace to "hide" the host’s file system and replace it with a specific directory structure—often called a rootfs.
Think of it like a house with many rooms. By default, you can walk through the whole house. Using a mount namespace is like installing a door that only opens into one specific bedroom. Once the process is inside that room, the "mount" command (which manages file system connections) is restricted. Even if the process executes ls /, it won't see the host’s /etc, /bin, or /home folders; it only sees the files provided by the container image.
A Quick Visualization
If you were to peek at the mounts inside a process that has its own mount namespace, you might see something like this:
# Inside the container, the view is restricted
$ mount
/dev/sda1 on / type ext4 (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec)
Notice that there is no sign of your actual host’s hard drives or sensitive system paths. The process is now locked into a virtualized "root" directory, ensuring that your container's environment remains portable and secure, regardless of the host machine it lands on.
Key Takeaway: Mount namespaces redefine the "root" of the filesystem for a process, ensuring that containers are isolated within their own directory structure and cannot access or modify the host system's files.