BiteSizedChunks.comLearn one small thing at a time.
Course contentsShow
← Linux
Lesson 102 of 1,8191. Shell Architecture and Process EnvironmentFree lesson

The Shell Execution Sandbox

Use kernel namespaces to create isolated sandboxes for running untrusted shell scripts.

In this lesson, you will learn how to use Linux kernel namespaces to restrict an untrusted shell script to its own private, isolated environment.

The Concept of Namespacing

When you run a command in your shell, it typically sees every other process, file, and network interface on your system. This is convenient for you, but dangerous if you are running an untrusted script. To solve this, the Linux kernel provides namespaces. Think of a namespace as a "bubble" that limits what a process can see and interact with.

When you launch a process inside a sandbox, you are essentially telling the kernel: "Give this process its own version of reality."

Creating a Sandbox with unshare

The most direct way to experiment with this is the unshare command. It allows you to run a program with some namespaces "unshared" from the parent shell.

For example, if you want to run a script so it cannot see the rest of your system's network or process table, you can execute:

# Create a private mount, network, and process namespace
sudo unshare --mount --net --pid --fork --mount-proc /bin/bash

Inside this new shell:

  1. --mount: The process gets its own file system view.
  2. --net: The process has an empty, isolated network stack (it won't see your internet connection).
  3. --pid: The process thinks it is the very first process (PID 1) on the system.
  4. --mount-proc: This tells the kernel to remount the /proc directory so the new process sees only the PIDs inside its own sandbox, not yours.

Why use this for Shell Scripts?

If you download a script from an untrusted source, running it directly is risky because it could access your documents or communicate over the network. By wrapping your execution in these namespaces, you create a "shell execution sandbox." Even if the script tries to probe your network or inspect your running processes, it will only see the empty, barren environment you provided. It is a powerful, low-overhead way to enforce security at the kernel level before the first line of the script even runs.

Key Takeaway: Kernel namespaces allow you to isolate untrusted shell scripts by creating a restricted "bubble" where the process has its own private view of the file system, network, and process tree.