In this lesson, you will learn how to identify kernel-level memory leaks specifically tied to containerized namespaces by tracking slab object allocations.
When a containerized application leaks kernel memory—such as lingering net_device structures or orphaned nsproxy objects—the memory is often hidden within the kernel's slab allocator rather than the user-space process memory. To track these down, we monitor the slab caches associated with namespace-specific objects.
Inspecting Slab Usage with slabtop
The slabtop utility provides a real-time view of kernel slab caches. When diagnosing leaks within namespaces, look for caches prefixed with net_ or nsproxy. If you observe a high number of active objects in net_namespace or file caches that do not decrease after the container is destroyed, you have likely found a kernel-level leak.
To isolate these, filter the output to focus on relevant objects:
# Sort by active objects to identify potential accumulation
slabtop -s a | grep -E 'net_|nsproxy|task_struct'
Deep Dive with Kernel Debugging
If slabtop indicates an accumulation of objects, you can confirm whether those objects are pinned by active references using the /proc filesystem. Since we know from previous lessons how to inspect namespace reference counts via lsns and procfs, we can correlate those counts with the slab data.
To get a granular view of which kernel functions are allocating these objects, you should combine slab monitoring with perf. For instance, you can record slab allocations for a specific namespace-related kernel function:
# Capture call stacks for slab allocation functions
perf record -e kmem:mm_slab_alloc -g --filter 'name == "net_namespace"'
perf report
If the perf trace shows that alloc_netdev or similar functions are being called without a corresponding free in the namespace tear-down path, you have confirmed that a kernel module or a mismanaged reference in the namespace lifecycle is preventing garbage collection. Remember that these kernel objects are reference-counted; a leak is almost always a sign that a subsystem (like a pending Netlink message or a dangling socket) still holds a reference to the namespace object, preventing the kernel from reclaiming the associated slab memory.
Key Takeaway: Identifying namespace memory leaks requires correlating slab cache object counts from slabtop with kernel stack traces via perf to ensure that objects are being properly freed during namespace destruction.