Linux Namespaces: A Virtual Slice of the OS

WHY IT EXISTS To run multiple applications on a single OS without them interfering with each other's resources, like network ports or file paths. Before namespaces, you either used heavyweight virtual machines or faced dependency conflicts on a shared system. Namespaces provide lightweight OS-level virtualization.

THE MENTAL MODEL Think of an apartment building. The building itself is the shared Linux kernel. Each apartment is a set of namespaces. Inside your apartment, you have your own private space, your own room numbers (process IDs), and your own network jack (network interface). You can't see into your neighbor's apartment, but everyone shares the building's foundation and plumbing (the single, shared kernel).

HOW IT WORKS The Linux kernel partitions resources by assigning them to a specific namespace. When a process makes a system call, the kernel ensures it only sees resources belonging to its own namespace. This creates isolated environments. The main types of namespaces are PID (process IDs), Net (network devices), Mnt (filesystem mount points), UTS (hostname), IPC (inter-process communication), and User (user and group IDs).

WHEN TO USE IT Use namespaces whenever you need process and resource isolation without the overhead of a full virtual machine. This is the fundamental technology behind all modern container runtimes like Docker, containerd, and Podman. It allows you to run, for example, two applications that both need to bind to port 80 by giving each its own isolated network namespace.

WHEN NOT TO USE IT Do not rely on namespaces as your sole security boundary for running untrusted, multi-tenant code. A vulnerability in the shared kernel can allow a process to escape its namespace and compromise the entire host system. For workloads requiring strong security guarantees, a full virtual machine with its own kernel is a safer choice.

ONE CANONICAL EXAMPLE Running a Docker container. When you execute docker run nginx, Docker creates a new set of namespaces for the Nginx process. It gets a new PID namespace where it becomes Process ID 1, as if it's the only thing running on a new machine. It also gets a new network namespace with its own private IP address and network interfaces, preventing port conflicts with the host or other containers.