Linux Kernel Basics: Modules, /proc, /sys, Namespaces and cgroups (How Containers Work)

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a co-working space

Why do we need this?

A co-working building in Baner has one manager (kernel). Each company gets its own cabin: they see only their own name board, Wi-Fi name and staff list (namespaces). The meter limits how much power and AC each cabin uses (cgroups). When a new printer arrives, the manager plugs in its driver (module). The notice board in the lobby shows live stats for everyone (/proc).

What is it?

Manager = kernel. Driver for the printer = module. Lobby board = /proc and /sys. Private cabin view = namespaces. Power meter = cgroups. Cabin = container.

How to do it (step by step)

2. Kernel version and boot options

Why do we need this?

Bugs, drivers and features depend on the kernel version.

What is it?

uname -r prints the running kernel; uname -a shows all. /proc/cmdline shows boot parameters. Installed kernels: rpm -q kernel or dpkg -l 'linux-image*'. grubby --info=ALL (RHEL) shows boot entries. A new kernel needs a reboot.

How to do it (step by step)

1. Running kernel.

uname -r

Output:

6.1.112-124.190.amzn2023.x86_64

What it means: Amazon Linux 2023.

2. Boot parameters.

cat /proc/cmdline

Output:

BOOT_IMAGE=(hd0,gpt1)/vmlinuz-6.1.112 root=UUID=... ro console=ttyS0

What it means: Passed by GRUB.

3. Add a boot option.

sudo grubby --update-kernel=ALL --args='mitigations=auto'

Output:

(no output)

What it means: Applies next boot.

3. Kernel modules: lsmod and modinfo

Why do we need this?

Drivers for disks, network cards and filesystems are modules loaded on demand.

What is it?

lsmod lists loaded modules with size and users. modinfo NAME shows description, version and parameters. Modules live in /lib/modules/$(uname -r). lspci -k shows which driver a device uses.

How to do it (step by step)

1. Loaded.

lsmod | head -4

Output:

Module   Size  Used by
ena    151552  0
nvme    53248  2

What it means: ENA network, NVMe disk.

2. Details.

modinfo ena | head -4

Output:

filename: /lib/modules/6.1.../ena.ko.xz
description: Elastic Network Adapter (ENA)
version: 2.12.0g

What it means: AWS network driver.

3. Device driver.

lspci -k | grep -A2 -i ethernet

Output:

00:05.0 Ethernet controller: Amazon.com ENA
 Kernel driver in use: ena

What it means: Confirms.

4. modprobe: load, unload, blacklist

Why do we need this?

You need a module for WireGuard, an extra filesystem, or to stop a buggy driver.

What is it?

modprobe NAME loads with dependencies; modprobe -r unloads. Load at boot: file in /etc/modules-load.d/NAME.conf. Options: /etc/modprobe.d/NAME.conf with 'options NAME key=val'. Blacklist: 'blacklist NAME' in /etc/modprobe.d. Avoid insmod/rmmod (no dependency handling).

How to do it (step by step)

1. Load.

sudo modprobe br_netfilter && lsmod | grep br_netfilter

Output:

br_netfilter 32768 0
bridge 315392 1 br_netfilter

What it means: Needed by Kubernetes.

2. At boot.

echo br_netfilter | sudo tee /etc/modules-load.d/k8s.conf

Output:

br_netfilter

What it means: Persistent.

3. Blacklist.

echo 'blacklist floppy' | sudo tee /etc/modprobe.d/no-floppy.conf

Output:

blacklist floppy

What it means: Not loaded again.

4. Unload.

sudo modprobe -r floppy

Output:

(no output)

What it means: Removed if unused.

5. dmesg: kernel messages

Why do we need this?

Hardware errors, OOM kills and driver problems show here first.

What is it?

dmesg -T shows readable times; -l err,warn filters level; -w follows live. journalctl -k does the same from the journal, and -k -b -1 shows the last boot.

How to do it (step by step)

1. Errors only.

sudo dmesg -T -l err,warn | tail -3

Output:

[Sun Oct 25 20:10] EXT4-fs warning (device nvme1n1): ...

What it means: Disk warning.

2. Last boot.

journalctl -k -b -1 | tail -2

Output:

kernel: Out of memory: Killed process 912 (node)

What it means: Why it crashed.

3. Live.

sudo dmesg -w

Output:

[ 9912.1] usb 1-1: new device

What it means: Plug and watch.

6. /proc: live process and system data

Why do we need this?

Every tool like ps, top and free reads /proc. You can read it directly.

What is it?

System files: /proc/cpuinfo, /proc/meminfo, /proc/loadavg, /proc/mounts, /proc/sys (tunables). Per process /proc/PID: cmdline, environ, status (memory, state), fd/ (open files), limits, cwd, exe, ns/ (namespaces), cgroup.

How to do it (step by step)

1. CPU model.

grep -m1 'model name' /proc/cpuinfo

Output:

model name : Intel(R) Xeon(R) Platinum 8259CL

What it means: Instance CPU.

2. Process memory.

grep -E 'VmRSS|State' /proc/3011/status

Output:

State: S (sleeping)
VmRSS: 1983420 kB

What it means: ~1.9 GB.

3. How it was started.

tr '\0' ' ' < /proc/3011/cmdline

Output:

java -Xmx2g -jar shop.jar

What it means: Full command.

4. Deleted but open file.

sudo ls -l /proc/3011/fd | grep deleted

Output:

9 -> /var/log/shop.log (deleted)

What it means: Space not freed until restart.

7. /sys: devices and kernel objects

Why do we need this?

/sys exposes devices, block queues and module parameters as files.

What is it?

/sys/block/DISK/queue/scheduler shows the I/O scheduler. /sys/class/net/IF/ has speed and statistics. /sys/module/NAME/parameters shows module options. /sys/fs/cgroup is the cgroup tree. Writing to some files changes behaviour live.

How to do it (step by step)

1. I/O scheduler.

cat /sys/block/nvme0n1/queue/scheduler

Output:

[none] mq-deadline kyber

What it means: none for NVMe.

2. Interface counters.

cat /sys/class/net/ens5/statistics/rx_dropped

Output:

15422

What it means: Drops.

3. Module option.

cat /sys/module/nvme_core/parameters/io_timeout

Output:

4294967295

What it means: EBS needs a high value.

8. Namespaces: what a process can see

Why do we need this?

Namespaces isolate containers from each other and from the host.

What is it?

Types: pid (process IDs), net (interfaces, ports), mnt (mounts), uts (hostname), ipc, user (UID mapping), cgroup, time. lsns lists them. ls -l /proc/PID/ns shows a process's namespaces. unshare creates new ones; nsenter enters existing ones; ip netns manages network namespaces.

How to do it (step by step)

1. List.

sudo lsns -t net

Output:

NS         TYPE NPROCS PID  COMMAND
4026531840 net  210    1    /usr/lib/systemd/systemd
4026532301 net  2      8812 nginx: master

What it means: nginx in a container.

2. New hostname world.

sudo unshare --uts --fork bash -c 'hostname box-a; hostname'

Output:

box-a

What it means: Host name unchanged outside.

3. New PID world.

sudo unshare --pid --fork --mount-proc bash -c 'ps -e'

Output:

PID TTY TIME CMD
  1 pts/0 00:00:00 bash
  2 pts/0 00:00:00 ps

What it means: Bash is PID 1.

4. Enter a container's network.

sudo nsenter -t 8812 -n ss -ltn

Output:

LISTEN 0 511 0.0.0.0:80

What it means: Debug without tools in the image.

9. Network namespaces with ip netns

Why do we need this?

This is exactly how Docker bridges and Kubernetes pods get networking.

What is it?

ip netns add NAME creates one. A veth pair is a virtual cable: one end in the host, one in the namespace. Give IPs, bring links up, and ping. ip netns exec NAME CMD runs a command inside.

How to do it (step by step)

1. Create.

sudo ip netns add red && sudo ip link add veth-h type veth peer name veth-r && sudo ip link set veth-r netns red

Output:

(no output)

What it means: Cable plugged.

2. Address.

sudo ip addr add 10.9.0.1/24 dev veth-h && sudo ip link set veth-h up && sudo ip netns exec red ip addr add 10.9.0.2/24 dev veth-r && sudo ip netns exec red ip link set veth-r up

Output:

(no output)

What it means: Both ends up.

3. Ping.

sudo ip netns exec red ping -c1 10.9.0.1

Output:

1 packets transmitted, 1 received

What it means: Works.

10. cgroups v2: how much a process can use

Why do we need this?

Without limits one runaway process can eat all CPU or memory and kill the server.

What is it?

cgroup v2 is one tree at /sys/fs/cgroup. Check: stat -fc %T /sys/fs/cgroup prints cgroup2fs. Each group has files: memory.max, memory.current, cpu.max ('quota period', e.g. 50000 100000 = half a CPU), pids.max, io.max. Put a PID in cgroup.procs. memory.events counts OOM kills.

How to do it (step by step)

1. Version.

stat -fc %T /sys/fs/cgroup

Output:

cgroup2fs

What it means: v2.

2. Make a group by hand.

sudo mkdir /sys/fs/cgroup/demo && echo 200M | sudo tee /sys/fs/cgroup/demo/memory.max && echo '50000 100000' | sudo tee /sys/fs/cgroup/demo/cpu.max

Output:

200M
50000 100000

What it means: 200 MB, half a CPU.

3. Move shell in.

echo $$ | sudo tee /sys/fs/cgroup/demo/cgroup.procs

Output:

2241

What it means: Children are limited too.

4. Which cgroup?

cat /proc/3011/cgroup

Output:

0::/system.slice/shop-api.service

What it means: systemd made it.

11. cgroups the easy way: systemd

Why do we need this?

systemd already puts every service in a cgroup, so set limits there instead of by hand.

What is it?

In a unit or drop-in: MemoryMax=1G, CPUQuota=150%, TasksMax=500, IOWeight=. Live: systemctl set-property UNIT MemoryMax=1G. One-off: systemd-run --scope -p MemoryMax=300M CMD. Watch with systemd-cgtop; tree with systemd-cgls.

How to do it (step by step)

1. Limit a service.

sudo systemctl set-property shop-api.service MemoryMax=1G CPUQuota=150%

Output:

(no output)

What it means: Persisted in a drop-in.

2. One-off job.

sudo systemd-run --scope -p MemoryMax=300M -p CPUQuota=50% tar czf /backup/www.tgz /var/www

Output:

Running scope as unit: run-r1b2.scope

What it means: Backup cannot hog.

3. Live top per cgroup.

systemd-cgtop -n 1

Output:

Control Group             Tasks %CPU Memory
/system.slice/shop-api    88    140  980M

What it means: Near the limit.

4. Docker uses the same.

docker run -d --memory 512m --cpus 1.5 nginx

Output:

f3a1...

What it means: cgroup limits.

12. Putting it together: a container from scratch

Why do we need this?

Seeing it once by hand removes the mystery of containers.

What is it?

Combine unshare (pid, mnt, uts, net), a root filesystem (an extracted image), chroot, and a cgroup limit. Real runtimes (runc, containerd) do the same plus seccomp, capabilities and overlay filesystems.

How to do it (step by step)

1. Get a root filesystem.

mkdir rootfs && docker export $(docker create alpine) | tar -x -C rootfs

Output:

(no output)

What it means: Alpine files.

2. Start a mini container.

sudo unshare --pid --uts --mount --net --fork chroot rootfs /bin/sh -c 'mount -t proc proc /proc; hostname mini; ps; hostname'

Output:

PID USER COMMAND
 1 root /bin/sh -c ...
mini

What it means: Own PIDs and name.

3. Container PID on host.

docker inspect -f '{{.State.Pid}}' web

Output:

8812

What it means: Just a host process.

13. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

14. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

15. Troubleshooting step by step

Why do we need this?

For kernel-level issues: read messages, then check the right file.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. Kernel log

sudo dmesg -T -l err,warn

2. Loaded drivers

lsmod

3. Device and driver

lspci -k

4. Process details

cat /proc/PID/status

5. Namespaces

sudo lsns

6. cgroup limits

systemctl show UNIT -p MemoryMax -p CPUQuotaPerSecUSec

16. Lab 1: Modules and /proc

Why do we need this?

Load a module at boot and read a process's details from /proc.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Info.

modinfo overlay | head -3

Output:

description: Overlay filesystem

2. Load.

sudo modprobe overlay && lsmod | grep overlay

Output:

overlay 151552 0

3. Persist.

echo overlay | sudo tee /etc/modules-load.d/overlay.conf

Output:

overlay

4. Start a process.

sleep 600 &

Output:

[1] 7001

5. Read it.

grep -E 'State|PPid' /proc/7001/status; ls -l /proc/7001/ns | head -3

Output:

State: S (sleeping)

17. Lab 2: Namespaces and cgroups

Why do we need this?

Make an isolated shell and a memory-limited job.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. PID namespace.

sudo unshare --pid --fork --mount-proc bash -c 'ps -e'

Output:

1 bash

2. UTS namespace.

sudo unshare --uts --fork bash -c 'hostname lab; hostname'

Output:

lab

3. Limited job.

sudo systemd-run --scope -p MemoryMax=100M stress-ng --vm 1 --vm-bytes 300M --timeout 20s

Output:

Running scope ... killed

4. Check events.

journalctl -k | grep -i 'memory cgroup out of memory' | tail -1

Output:

Memory cgroup out of memory: Killed process

5. Service limit.

sudo systemctl set-property sshd.service TasksMax=200 && systemctl show sshd -p TasksMax

Output:

TasksMax=200

18. Frequently asked questions

19. Interview questions and answers

Beginner level

Mid level level

Senior level

20. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.