Name three Linux namespaces and explain what each one isolates.

WHAT THIS TESTS: This question probes whether you know how containers actually work at the kernel level. Anyone can run Docker commands; senior engineers should understand that containers are not magic but rather a composition of specific Linux kernel features. Namespaces are the isolation primitive, and the interviewer wants to see that you can name concrete types, describe exactly what global resource each one virtualizes, and ideally reference the system-call API or procfs entries that expose them.

A GOOD ANSWER COVERS: A strong response names three or more namespaces from the eight available types and precisely states what each isolates. For example, the PID namespace isolates process IDs so that init inside the container is PID 1 and host PIDs are invisible. The Network namespace isolates network devices, routing tables, firewall rules, and port numbers so the container can have its own loopback and IP stack. The Mount namespace isolates filesystem mount points so that a container's rootfs does not leak to the host. Other valid choices include UTS for hostname and NIS domain, IPC for System V and POSIX message queues, User for UID and GID mappings, Cgroup for the cgroup root directory view, and Time for boot and monotonic clocks. Mentioning the CLONE_NEW* flags used with clone, unshare, or setns, or noting that /proc/pid/ns/ exposes stable namespace file descriptors, signals that you have worked with the API directly rather than just reading docs.

COMMON WRONG ANSWERS: The biggest red flag is conflating namespaces with cgroups. Namespaces isolate what a process can see; cgroups limit what a process can use. Saying that namespaces throttle CPU or memory is a fundamental misunderstanding. Another weak pattern is answering with Docker abstractions like overlay networks or volumes instead of kernel namespaces. Listing a namespace without explaining the specific global resource it wraps also scores poorly because it suggests memorization without comprehension.

LIKELY FOLLOW-UPS: An interviewer may ask what happens if you share a namespace between containers, how you enter an existing namespace with nsenter or setns, or why user namespaces are special because unprivileged users can create them since Linux 3.8. They might also ask how PID namespaces interact with signal delivery or how mount propagation flags affect shared mount namespaces.

ONE CONCRETE EXAMPLE: If you run a container and it binds to port 80, that works without host conflict because the container is in its own Network namespace created with CLONE_NEWNET. Inside that namespace the process sees its own eth0 and loopback, while on the host the veth pair end is attached to a bridge. The process also believes it is PID 1 because of CLONE_NEWPID, and its filesystem root is isolated by CLONE_NEWNS, all orchestrated by the runtime before execing the container payload.

Source: man7.org namespaces(7)