In this lesson, you will learn how misconfigured namespaces can cause "kernel object leakage," where system resources remain permanently trapped even after a container stops.
The Problem: Orphaned Kernel Objects
Namespaces provide isolation by creating private views of system resources, such as PIDs, network interfaces, or mount points. The Linux kernel tracks these resources using internal objects (like struct pid or struct net).
Normally, when the last process in a namespace terminates, the kernel destroys the associated objects and frees the memory. However, if a process or a kernel thread keeps a reference to a resource inside that namespace—or if a file descriptor remains open—the namespace cannot be fully torn down. This results in kernel object leakage.
A Concrete Illustration
Imagine a scenario where a containerized application spawns a subprocess that accidentally holds an open file descriptor pointing to a resource in its mnt (mount) namespace. Even if the container "dies," the kernel cannot release the mount namespace object because the kernel's reference counter remains above zero.
# A common sign of leakage is seeing persistent, "ghost" namespaces
# that have no active processes but still exist in the kernel:
lsns -t net
# If you see a namespace with no associated processes (NPROC = 0),
# you are looking at a leaked kernel object.
Resource Exhaustion
When these objects leak, they do not just consume memory; they consume kernel IDs and slots. For example, every network namespace consumes memory for its routing tables and socket structures. If an orchestration error causes your system to leak hundreds of these namespaces, the kernel may hit its limit for concurrent namespaces. Once this limit is reached, the host will refuse to start any new containers or even execute basic system tasks, leading to a system-wide denial of service.
To prevent this, ensure that your application logic explicitly closes file descriptors and cleans up child processes before exiting. Monitoring the count of active namespaces via /proc or lsns is a critical defense against these silent memory and resource vampires.
Key Takeaway: Namespace leaks occur when kernel references to a namespace persist after its processes have exited, eventually leading to system-wide resource exhaustion.