Linux – Writing a Simple Container App with Namespaces

One of the building blocks to implement containers is Linux namespaces. Namespaces control what a process can see. It can be the processes IDs, mount points, network adapters and more.

To use namespaces we call the clone(2) system call.

Creating a child process – fork vs clone

To create a new process in Linux, we can use fork(2) or clone(2) system calls. We use fork(2) to create a new child process with a separate memory mapping (using CoW) , we use clone(2) to create a child process that shares resources with its parent. One use of clone is to implement multithreading, other use is to implement namespaces

Namespaces with clone(2)

To create a child process in a new namespace and isolated resources we need to use one or more of the following flags :

  • CLONE_NEWNET  – isolate network devices
  • CLONE_NEWUTS – host and domain names (UNIX Timesharing System)
  • CLONE_NEWIPC – IPC objects
  • CLONE_NEWNS – mount points (file systems)
  • CLONE_NEWUSER – users and groups

Simple Example – NEWPID

To create a child process with PID=1 (new processes tree) call clone(2) with CLONE_NEWPID:

getpid() on the child process returns 1, getppid() returns 0. If the child process creates another child it will get a process id from the new tree

Full example:

The main creates a child process in a new PID namespace and send its PID to the child. The child creates 3 children.

If the child process try to kill the parent (out of its namespace) – nothing happens but it can kill a process in its namespace (in this case the first child)

If you build and run this sample (run with sudo)

As you can see the PIDs are 1-4 and the first child didn’t finish (SIGKILL)


Isolates Network Interfaces

To create a child process with different network interfaces use CLONE_NEWNET:

To create a virtual network adapter we can run ip command:

Now the child should run the command:

We can code all these commands but for simplicity lets use the system(3) library function

Full Example:

Run this test – the output:

The child sees only the virtual adapter and can ping the parent using it


Mount Points and file system

To implement a container we need to isolate also the file system. It can be done using CLONE_NEWNS. Before coding , lets build a simple file system using BusyBox or BuildRoot

The simplest way is using buildroot – it is based on busybox.

Download and extract the package, use make menuconfig to enter the configuration menu, just exit and save the default selection and run make

It will take a few minutes , after the build is finished you will find a file system in buildroot-2017.11.2/output/target

copy the content to another folder – in my example fs and add some device files to the /dev directory using mknod commands (buildroot can’t do that because it doesn’t run with sudo)

Full Example 

We create a child process in a new namespace (with PIDs, network, mounts, IPC and UTS) , the parent configure the virtual adapters (using ip link) and set its ip address

The child change the hostname, change the root folder to our buildroot output , change the current directory to ‘/’ , mount proc so ps and other tools will work and set an ip address.

The last step the child does is calling the busybox shell (/bin/sh)

Run this program using sudo – you will get a different shell, file system and network:

Thats it!!

You can find the code with the full Buildroot image here

This is just a simple example to understand the concept. to implement a full container you need also to add capabilities, control groups and more








2 thoughts on “Linux – Writing a Simple Container App with Namespaces

  1. A good quick overview of namespaces!

    I’d like to suggest a minor improvement though. After building the rootfs with Buildroot, I suggest you extract output/images/rootfs.tar.gz, which is the real filesystem image. It contains the /dev entries, so you will not need to create them manually.

    The output/target/ directory does not contain /dev entries because it is not the real root filesystem. This is because Buildroot does not run as root and thus it cannot create device files directly. There’s a file called “THIS_IS_NOT_YOUR_ROOT_FILESYSTEM” in output/target/ that explains this in better detail.

    1. Correct. I just wanted to keep the example simple for learning purpose but i should fix it

Leave a Reply

Your email address will not be published.