In this lesson, you will learn how mount namespace isolation allows you to create private filesystem views, ensuring that processes only see the storage resources they are explicitly granted.
The Concept of a Private View
Normally, when you run the mount command on a Linux system, you see every disk partition, network share, and virtual filesystem attached to the kernel. This is a "global" view. In a containerized environment, however, we often want to hide these details. If you have multiple containers running on one host, you don’t want Container A to be able to browse the sensitive files mounted in Container B.
Mount namespace isolation solves this by providing a process (or group of processes) with its own private table of mount points. When a process enters a new mount namespace, its view of the directory hierarchy is decoupled from the host’s view. Changes made within the namespace—such as mounting a new disk or unmounting a directory—do not affect the host or other namespaces.
How it Works
Think of the host’s mount table as a master list. When a new namespace is created, it starts as a copy of the host's list. If a containerized application mounts a specific data volume, that action is recorded only in the container's private list.
You can experiment with this behavior using the unshare command:
# Create a new mount namespace and start a shell
sudo unshare --mount --fork /bin/bash
# Inside the new shell, mount a dummy filesystem
mount -t tmpfs tmpfs /mnt
# Check if the host can see it
# (Open a separate terminal on the host and run 'findmnt /mnt')
# It will not be there!
By restricting mount visibility, you prevent "leaky" storage configurations. A process in a private namespace might see its own /var/lib/data directory, while being completely unaware that the host is using an entirely different physical disk for the same path. This isolation is the foundation of secure containerized storage, ensuring that filesystem layouts remain modular, predictable, and protected from unauthorized discovery.
Key Takeaway: Mount namespace isolation creates a private filesystem hierarchy for a process, ensuring it only interacts with the storage resources specifically mapped to its unique environment.