How do the seven Linux kernel namespaces isolate container processes from the host operating system?

A Linux container is not an emulation or virtual machine; it is a standard Linux process isolated by kernel namespaces and restricted by cgroups. The kernel provides 7 fundamental namespaces: (1) PID (CLONE_NEWPID): Virtualizes process IDs, allowing the container entrypoint process to be PID 1 while appearing as an unprivileged high PID on the host; (2) NET (CLONE_NEWNET): Provides an isolated network stack with independent network interfaces (veth pairs), routing tables, firewall (iptables/nftables) rules, and port bindings; (3) MNT (CLONE_NEWNS): Isolates filesystem mount tables, allowing the container to mount filesystems without polluting the host; (4) IPC (CLONE_NEWIPC): Isolates System V IPC and POSIX message queues; (5) UTS (CLONE_NEWUTS): Allows setting an independent container hostname and domain name; (6) USER (CLONE_NEWUSER): Maps container UID 0 (root) to an unprivileged host UID (e.g. UID 100000), enabling secure rootless containers; (7) CGROUP (CLONE_NEWCGROUP): Isolates the view of /proc/self/cgroup to prevent processes from inspecting parent cgroup hierarchies.

How does OverlayFS union mount lowerdir, upperdir, workdir, and merged layers during container execution?

OverlayFS is a union mount filesystem that combines multiple underlying directories into a single unified presentation layer. It consists of: (1) lowerdir: One or more read-only base directories containing container image layers (e.g. Ubuntu base OS, packages, application binaries); (2) upperdir: A single read-write directory where all runtime container modifications (new files, edited files) are written; (3) workdir: An empty scratch directory used by the kernel for atomic directory operations and file preparation; (4) merged: The unified mount point exposed to the container. When a container reads a file, the kernel searches upperdir first, then lowerdir layers from top to bottom. When modifying a file from lowerdir, OverlayFS performs a Copy-up operation: the entire file is copied from lowerdir into upperdir before being written. Deletions create a character device file with major/minor 0,0 (a Whiteout file) in upperdir, masking the underlying lowerdir file from directory listings.

Why is pivot_root secure against container escapes while chroot can be trivially broken?

The legacy chroot(2) system call only changes the root directory pointer (current->fs->root) of the current process. It does not alter the mount namespace or detach the host root filesystem. A process with root capabilities (CAP_SYS_CHROOT) inside a chroot jail can easily escape by creating a child directory, opening a file descriptor to the current root, calling chroot() to the child, and executing fchdir() repeatedly on the open descriptor until it traverses above the chroot boundary. In contrast, pivot_root(new_root, put_old) moves the root mount point of the entire mount namespace. The old host root filesystem is unmounted completely via umount2(put_old, MNT_DETACH). Because the old root mount no longer exists within the container mount table, no file descriptor or directory traversal trick can reach the host filesystem.

How does user namespace UID/GID mapping enable secure rootless containers (Podman / rootless Docker)?

In a rootless container, the container runtime runs entirely as an unprivileged user without setuid binaries or sudo access. The runtime creates a USER namespace (unshare(CLONE_NEWUSER)) and configures /proc/self/uid_map and /proc/self/gid_map via helper utilities (newuidmap and newgidmap). A mapping entry such as "0 100000 65536" translates container UID 0 (root inside container) to host UID 100000, container UID 1 to host UID 100001, and so forth. Inside the container namespace, the process possesses full capabilities (CAP_CHOWN, CAP_NET_ADMIN) over its own sub-namespaces and files owned by UID 0. However, outside on the host kernel, any syscall is executed with the unprivileged privileges of host UID 100000, making kernel privilege escalation and host filesystem tampering impossible.

What is the exact execution sequence of an OCI runtime (runc / crun) between clone, setns, and execve?

The Open Container Initiative (OCI) runtime specification defines how container engines spawn containers: (1) Configuration: The caller generates config.json containing rootfs path, namespace flags, cgroup limits, and seccomp profiles; (2) Pre-start: The runtime executes clone(2) with CLONE_NEW* namespace flags or setns(2) to join existing namespaces; (3) Cgroups: The parent process places the child PID into dedicated cgroups (memory.max, cpu.max); (4) Rootfs Setup: Inside the child mount namespace, the runtime mounts OverlayFS, mounts /proc, /sys, /dev, /dev/pts, and executes pivot_root(new_root, old_root) followed by umount2(old_root, MNT_DETACH); (5) Security Lockdown: The runtime applies seccomp BPF syscall filters and drops unneeded Linux capabilities (retaining only essential ones like CAP_NET_BIND_SERVICE); (6) Execution: The process executes execve(2) to replace the runtime binary with the target container entrypoint application.

What are Linux Capabilities and why is dropping CAP_SYS_ADMIN the most critical step in container hardening?

Traditional UNIX security divides privileges into two buckets: unprivileged (UID != 0) and root (UID == 0). Linux Capabilities split root privileges into approximately 40 distinct, fine-grained permissions. The most powerful capability is CAP_SYS_ADMIN, often referred to as "the new root" because it permits mounting filesystems, setting kernel parameters via sysctl, loading eBPF programs, configuring network devices, and attaching debuggers. Standard OCI runtimes drop CAP_SYS_ADMIN, CAP_SYS_RAWIO, CAP_SYS_MODULE (loading kernel modules), and CAP_SYS_PTRACE by default. Retaining only minimal capabilities (such as CAP_CHOWN, CAP_SETUID, and CAP_NET_BIND_SERVICE) prevents a compromised container application from exploiting kernel vulnerabilities to escape into the host.

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

OCI Runtime Spec Linux Kernel Namespaces OverlayFS Union Mount

Linux Namespaces, OCI Container Runtime & OverlayFS Architecture Studio

Architect bare-metal Linux containers from first principles: explore kernel isolation across 7 namespaces (PID, NET, MNT, IPC, UTS, USER, CGROUP), simulate OverlayFS Copy-on-Write layer merges and whiteout deletions, verify pivot_root vs chroot jailbreak security, and synthesize production OCI config.json and C/Rust runtime blueprints.

7 of 7 Active

Isolated Namespaces

PID 1 (Host: 10,482)

Process Virtualization

UID 0 -> 100,000

Rootless User Mapping

3 Lower + 1 Upper

OverlayFS Layers

pivot_root (Secure)

Root Isolation Type

CAP_SYS_ADMIN Dropped

Capability Profile

1. Linux Kernel Namespaces Virtualization Matrix

Toggle active kernel namespaces to observe process tree, network stack, and user ID isolation

CLONE_NEWPID
PID Virtualization

CLONE_NEWNET
Network Stack

CLONE_NEWNS
Mount Table

CLONE_NEWIPC
IPC Message Queues

CLONE_NEWUTS
Hostname (my-container)

CLONE_NEWUSER
UID/GID Mapping

CLONE_NEWCGROUP
Cgroup Hierarchy

Container has full namespace isolation. Process runs as PID 1 inside container (mapped to host PID 10482). Network isolated via veth0 pair. User UID 0 maps to host UID 100000 (Rootless mode). Old root detached via pivot_root.

2. OverlayFS Union Mount & Copy-Up Simulator

Simulate file modifications, additions, and whiteout deletions across stacked image layers

/merged (Container Unified Presentation View)
/etc/hosts (base), /bin/dash (base), /lib/libc.so (base)

Target Rootfs

/upperdir (Container Ephemeral Read-Write Layer)
[Empty - Zero runtime changes]

Read / Write

/workdir (Kernel Scratch Directory)
Used internally by kernel for atomic directory preparation and copy-up staging

Kernel Internal

/lowerdir (Layer 2: Application Dependencies & Runtime)
/usr/bin/node, /usr/lib/node_modules

Read-Only

/lowerdir (Layer 1: Base Operating System - Ubuntu 24.04 LTS)
/etc/hosts, /bin/dash, /bin/sh, /lib/libc.so.6

Read-Only

Linux Namespaces, OCI Container Runtime & OverlayFS Architecture Studio

1. Linux Kernel Namespaces Virtualization Matrix

2. OverlayFS Union Mount & Copy-Up Simulator

3. Production OCI Runtime Blueprints & Specifications

🔍 Companion Workbenches & Verification Tools

Linux Virtual Memory, Page Faults, TLB & HugePages Architecture Studio

Unix Timestamp & Epoch Converter

Linux Epoll, Edge-Triggered & Event Loop Architecture Studio

Linux Kernel Slab Allocator & Free List Hardening Studio | Heap Exploitation Mitigations

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions