In this lesson, you will learn how Linux Namespaces act as the "invisible walls" that allow containers to exist safely on the same machine without seeing or interfering with one another.
The Problem of Shared Reality
Imagine you are living in a giant apartment building (the Linux Kernel). Usually, everyone shares the hallways, the lobby, and the mailroom. If you try to change your front door lock, you might accidentally lock your neighbor out. On a computer, if two applications share the same "view" of the system, they can see each other’s processes, network ports, and files, which is a security and management nightmare.
The Namespace Solution
Linux Namespaces provide a way to partition the kernel's resources so that a group of processes sees one set of resources, while another group sees an entirely different set. Even though all these processes are running on the same underlying operating system, the kernel "tricks" them into thinking they are the only ones on the system.
When you run a container, Docker uses several types of namespaces to isolate it:
- PID Namespace: The process in your container thinks it is Process ID 1 (the root process), even if it is actually Process ID 5432 on your host machine.
- Network Namespace: The container gets its own virtual network stack, meaning it can have its own IP address and listen on ports without conflicting with the host or other containers.
- Mount Namespace: The container sees its own isolated filesystem, preventing it from browsing the host’s sensitive system folders.
Seeing it in Action
When you execute a command inside a container, you are witnessing these namespaces at work. Compare these two commands:
# On your host machine
ps aux | grep nginx
# Inside a Docker container
docker run -d nginx
docker exec <container_id> ps aux
On your host, ps shows you every process running on the system. Inside the container, the same command shows only the nginx process and the ps command itself. The container is blind to the host's processes because the PID namespace has created a private, restricted view of the world.
Key Takeaway: Namespaces are the fundamental feature of the Linux kernel that grants containers their own "private bubble," ensuring processes remain isolated, secure, and unaware of the host’s broader system state.