In this lesson, you will learn how the Linux kernel uses mount namespaces to create an isolated "bubble" for a process’s filesystem view.
Understanding the Mount Namespace
In a standard Linux environment, every process sees the same global directory tree, starting from the root directory /. If you list the contents of /, you see the same system files, binaries, and libraries as every other process on your machine.
A mount namespace changes this by decoupling a process’s view of the filesystem from the rest of the system. When a container process is placed into its own mount namespace, it can be given a unique "root" directory that exists independently of the host’s root. Changes made to the mount table within that namespace—such as mounting a new filesystem or unmounting an existing one—are invisible to the rest of the system.
How Isolation Works
Imagine your system has a folder at /var/lib/my-container-root. Inside this folder, you have a minimal set of Linux binaries (like ls, bash, and cat). To isolate this, the kernel performs two primary steps:
- Isolation: It creates a new mount namespace for the container process.
- Re-rooting: It uses the
pivot_rootsystem call to switch the process's root directory to the container’s folder.
To the container process, the directory /var/lib/my-container-root now is /. If the process runs ls /, it no longer sees the host's /bin or /etc. Instead, it sees only the files you provided within its isolated environment.
# Conceptual representation of switching the root directory
# The process is moved into a new namespace and its root is shifted
pivot_root("/var/lib/my-container-root", "/var/lib/my-container-root/old_root")
Because this isolation happens at the kernel level, the process remains secure. It cannot "climb out" of its namespace to see the host's sensitive configuration files, even though it shares the same underlying physical storage hardware. This separation allows you to run multiple containers, each with its own unique filesystem configuration, side-by-side on the same kernel without them ever realizing the others exist.
Key Takeaway: Mount namespaces allow a process to see a private, restricted view of the filesystem, effectively isolating its root directory from the host system.