In this lesson, you will learn how to implement sidecar-like patterns by programmatically attaching new processes to the existing namespaces of an external entity.
While container runtimes typically manage isolation boundaries, "Advanced Namespace Sharing" allows you to break those boundaries for specific debugging or integration needs. By joining the namespaces of an existing process, you can force a new process—like a diagnostic tool or a sidecar proxy—to live inside the same network, PID, or mount environment as an already running application.
The Mechanism of Namespace Joining
To join an existing namespace, you interact with the /proc/[pid]/ns/ directory. Each file here acts as a handle for a specific namespace type. When you open one of these files and use the setns() system call, the calling thread is moved into that namespace.
Consider a scenario where you have a web server running in PID 1234. You want to run a network packet sniffer inside that same server's network namespace without restarting the container:
int fd = open("/proc/1234/ns/net", O_RDONLY);
// Join the network namespace of PID 1234
setns(fd, CLONE_NEWNET);
close(fd);
// Now, any network-related syscalls will operate
// within the web server's network stack.
Implementing Sidecar Patterns
This "joining" capability is the foundation of sidecar patterns. Instead of architecting a container to contain multiple tightly coupled binaries, you can launch a specialized binary later in the process lifecycle. By joining the PID namespace of a target, the sidecar gains the ability to see and signal the primary process using standard Unix signals, which is otherwise impossible due to PID isolation.
This approach is highly effective for "side-loading" instrumentation. You can inject a monitoring agent into an existing namespace that has no knowledge of the agent's existence, allowing you to observe its filesystem views or network traffic without modifying the primary application's environment or binary footprint.
Key Takeaway: By using setns to inherit the handles from /proc/[pid]/ns/, you can dynamically bridge disparate processes into a shared execution environment, enabling powerful sidecar-like observability and control without requiring prior container configuration.