47.4 Namespaces and cgroups: how isolation really works

Example 1: List the namespaces of your own shell

Type this:

ls -l /proc/$$/ns | awk '{print $9, $11}'

You will see:

cgroup cgroup:[4026531835]
ipc ipc:[4026531839]
mnt mnt:[4026531841]
net net:[4026531840]
pid pid:[4026531836]
uts uts:[4026531838]

What it means: $$ is the ID of your shell. Each line is one namespace with an ID number. All normal programs on the host share these same numbers.

Example 2: List the namespaces of a container

Type this:

docker run -d --name ns1 nginx:1.27
sudo ls -l /proc/$(docker inspect -f '{{.State.Pid}}' ns1)/ns | awk '{print $9, $11}'

You will see:

ipc ipc:[4026532305]
mnt mnt:[4026532303]
net net:[4026532308]
pid pid:[4026532306]
uts uts:[4026532304]

What it means: The numbers are different from the host's. The container lives in its own private rooms.

Example 3: Use lsns to see all namespaces

Type this:

sudo lsns -t net

You will see:

        NS TYPE NPROCS   PID USER    COMMAND
4026531840 net     118     1 root    /sbin/init
4026532308 net       2  2235 root    nginx: master process

What it means: lsns lists namespaces. The host has one network namespace with 118 processes; the nginx container has its own with 2.

Example 4: Inside: only my own processes

Type this:

docker exec ns1 ps -e 2>/dev/null || docker exec ns1 ls /proc | grep -E '^[0-9]+$'

You will see:

1
29
30

What it means: nginx has no ps, so we list /proc instead. Only a few numbers, starting with 1. The container cannot see the 100+ host programs.

Example 5: Same process, two numbers

Type this:

docker inspect -f '{{.State.Pid}}' ns1
docker exec ns1 cat /proc/1/comm

You will see:

2235
nginx

What it means: The host calls it 2235. Inside, it is process 1. One process, two names, because of the PID namespace.

Example 6: Share the host's process list on purpose

Type this:

docker run --rm --pid=host alpine ps -e | wc -l

You will see:

124

What it means: --pid=host turns the wall off, so the container sees all host processes. Monitoring tools like Datadog agents use this. Never use it for normal apps.

Example 7: Container has its own IP

Type this:

docker exec ns1 cat /etc/hosts | tail -1

You will see:

172.17.0.2  6f0c1a2b3c4d

What it means: The container got its own address, 172.17.0.2, on a private Docker network.

Example 8: The host has different interfaces

Type this:

ip -brief addr | head -3

You will see:

lo       UNKNOWN  127.0.0.1/8
ens5     UP       10.0.1.25/24
docker0  UP       172.17.0.1/16

What it means: The host has its own network card (ens5) and a bridge called docker0 that links containers. Chapter 51 covers this in depth.

Example 9: No network at all

Type this:

docker run --rm --network none alpine ip addr | grep inet

You will see:

inet 127.0.0.1/8 scope host lo

What it means: With --network none, the container's network namespace has only the loopback address. Banks use this for jobs that must never touch the network.

Example 10: Each container has its own hostname

Type this:

hostname
docker run --rm alpine hostname
docker run --rm --hostname billing alpine hostname

You will see:

ip-10-0-1-25
4b1e7d9c2a10
billing

What it means: The host name, a random container name, and a name we chose with --hostname.

Example 11: A file made inside stays inside

Type this:

docker run --rm alpine sh -c 'echo hi > /only-here.txt; ls /only-here.txt'
ls /only-here.txt

You will see:

/only-here.txt
ls: cannot access '/only-here.txt': No such file or directory

What it means: The container wrote a file in its own filesystem. The host does not have it. That is the MNT namespace.

Example 12: Different users inside and outside

Type this:

docker run --rm alpine id

You will see:

uid=0(root) gid=0(root)

What it means: Inside, you are root by default. Rootless mode (lesson 47.10) uses the USER namespace to map this root to a normal user on the host, which is safer.

Example 13: Start the main app

Type this:

docker run -d --name app nginx:1.27

You will see:

8e1f...

What it means: A normal nginx container. It listens on port 80 inside its own network namespace.

Example 14: A helper joins the app's network

Type this:

docker run --rm --network container:app alpine wget -qO- localhost:80 | grep title

You will see:

<title>Welcome to nginx!</title>

What it means: The helper asked localhost, and nginx answered. Both share one network namespace, so localhost means the same place for both.

Example 15: A helper sees the app's processes

Type this:

docker run --rm --pid container:app alpine ps -o pid,comm

You will see:

PID   COMMAND
    1 nginx
   29 nginx
   35 ps

What it means: With a shared PID namespace, the helper sees nginx as process 1. Debug tools at Uber use this to look inside a running app without changing its image. Clean up with docker rm -f app.

Example 16: Find the cgroup version

Type this:

docker info --format '{{.CgroupVersion}}'

You will see:

2

What it means: Modern Linux uses cgroup version 2. The files we read below are version 2 files.

Example 17: See the cgroup of a container

Type this:

cat /proc/$(docker inspect -f '{{.State.Pid}}' ns1)/cgroup

You will see:

0::/system.slice/docker-6f0c1a2b3c4d....scope

What it means: The container's process sits in its own cgroup folder, named after the container ID.

Example 18: No limit set means max

Type this:

docker exec ns1 cat /sys/fs/cgroup/memory.max

You will see:

max

What it means: We gave no limit, so this container may use all memory on the host. That is risky on a shared server.

Example 19: Set a memory limit

Type this:

docker run -d --name small --memory 128m nginx:1.27
docker exec small cat /sys/fs/cgroup/memory.max

You will see:

134217728

What it means: 128 MB in bytes. The kernel now enforces this wall.

Example 20: Watch the usage live

Type this:

docker stats --no-stream --format '{{.Name}} {{.MemUsage}}' small

You will see:

small 3.4MiB / 128MiB

What it means: The app uses 3.4 MB of its 128 MB allowance.

Example 21: Cross the limit on purpose

Type this:

docker run --name hog --memory 50m alpine sh -c 'tail /dev/zero'
docker inspect -f '{{.State.OOMKilled}} {{.State.ExitCode}}' hog

You will see:

(no output, the container stops)
true 137

What it means: tail /dev/zero eats memory forever. The kernel killed it at 50 MB. Exit code 137 plus OOMKilled true is the sign you will see at work when an app at Paytm or PhonePe needs a bigger limit.

Example 22: Limit CPU to half a core

Type this:

docker run -d --name cpu1 --cpus 0.5 alpine sh -c 'while true; do :; done'
docker stats --no-stream --format '{{.Name}} {{.CPUPerc}}' cpu1

You will see:

cpu1 50.12%

What it means: The loop wants 100% but gets only 50%. The other apps on the server stay fast.

Example 23: See the CPU rule in the cgroup

Type this:

docker exec cpu1 cat /sys/fs/cgroup/cpu.max

You will see:

50000 100000

What it means: Out of every 100,000 microseconds, this container may run for 50,000. That is half a CPU.

Example 24: Limit the number of processes

Type this:

docker run --rm --pids-limit 20 alpine sh -c 'for i in $(seq 1 30); do sleep 60 & done; wait'

You will see:

sh: can't fork: Resource temporarily unavailable

What it means: The container could start only 20 processes. A buggy script at a bank cannot take down the whole server. Clean up with docker rm -f ns1 small hog cpu1.

Example 25: Start with a small limit

Type this:

docker run -d --name shop --memory 128m --cpus 0.5 nginx:1.27
docker stats --no-stream --format '{{.Name}} {{.MemUsage}} {{.CPUPerc}}' shop

You will see:

shop 3.2MiB / 128MiB 0.00%

What it means: The shop container may use 128 MB and half a CPU.

Example 26: Raise the limits live

Type this:

docker update --memory 512m --memory-swap 512m --cpus 2 shop

You will see:

shop

What it means: Docker prints the name to confirm. We set memory-swap equal to memory so there is no extra swap space.

Example 27: Check the new limits

Type this:

docker exec shop cat /sys/fs/cgroup/memory.max /sys/fs/cgroup/cpu.max

You will see:

536870912
200000 100000

What it means: 512 MB and two full CPUs. The app never stopped. Clean up with docker rm -f shop.