In this lesson, you will learn how to extract granular namespace metadata directly from the Linux kernel’s virtual filesystems to identify process isolation boundaries.
While we often use ip netns or nsenter to interact with namespaces, these are merely high-level abstractions. At the kernel level, Linux exposes the state of namespaces through /proc and /sys, providing an authoritative source of truth for observability tools.
Inspecting via Procfs
Every process on your system has a directory under /proc/[pid]/ns/. This directory contains a set of symbolic links, each representing a namespace type (e.g., net, mnt, uts, pid, ipc, cgroup, and user). If you run ls -l /proc/self/ns/, you will see entries like:
lrwxrwxrwx ... net -> 'net:[4026531992]'
lrwxrwxrwx ... mnt -> 'mnt:[4026531840]'
The string in brackets is the inode number of the namespace. Because Linux treats namespaces as first-class objects with their own inodes, you can determine if two processes share the same namespace simply by comparing their inode numbers. If two processes show the same inode for net, they are network-isolated together.
Inspecting via Sysfs
While procfs is process-centric, sysfs provides a hardware-centric view. You can inspect the namespace context of devices through /sys/class/net/. For example, checking the symbolic link at /sys/class/net/<interface>/netns (if enabled by specific kernel configurations or driver implementations) or by examining the ifindex reveals which namespace currently owns a network interface.
Beyond network interfaces, sysfs is critical for inspecting namespace-aware kernel objects, such as cgroup controllers. By traversing /sys/fs/cgroup/, you can inspect how resource accounting is tied to specific namespaces.
Why this matters
Manual inspection via these filesystems is the foundation for low-level observability. By programmatically reading these symlinks or checking the /proc directory structure, you can bypass user-space utilities to build custom diagnostic agents that verify process isolation without relying on the state of external binaries.
Key Takeaway: Namespaces are represented in the kernel as objects with unique inodes exposed via /proc/[pid]/ns/, allowing you to programmatically verify process isolation by comparing their inode identifiers.