In this lesson, you will learn how to manipulate mount namespaces to provide a process with a unique, isolated view of the system’s filesystem hierarchy.
While we previously explored PID namespaces for process isolation, mount namespaces are what truly allow us to reshape the "world" a process perceives. By default, every process sees the same global mount table. However, when a process is started in a new mount namespace, its mount table is decoupled from the host. This allows you to mount, unmount, or change mount flags (like making a directory read-only) without affecting the rest of the system.
Creating a Private Filesystem View
The power of this isolation lies in the ability to create "chroot-like" environments that are far more secure and flexible. You can use the unshare command to experiment with this behavior. For example, if you run the following command, you create a new mount namespace:
sudo unshare --mount --fork bash
Inside this new shell, you can mount a temporary filesystem (like tmpfs) over a sensitive host directory:
mount -t tmpfs none /etc
If you list the contents of /etc in this shell, you will see it is empty or modified, reflecting only your new tmpfs mount. Crucially, if you open a different terminal on your host, you will see that your original /etc remains completely untouched and intact. The kernel tracks these as two distinct filesystem views belonging to different namespaces.
Why this matters
This mechanism is the foundation for container filesystems. Instead of exposing the entire host disk to a process, you can create a private mount namespace, pivot_root into a restricted directory containing only the necessary binaries and libraries, and mask out sensitive system paths. This ensures that even if a process is compromised, it cannot traverse the host's actual filesystem, effectively "trapping" the process in a synthetic reality.
Key Takeaway: Mount namespaces allow a process to maintain its own independent mount table, enabling the isolation, masking, and replacement of filesystem paths without impacting the host system's global state.