Linux Namespaces Isolation
Discussions center on using Linux kernel namespaces (user, PID, mount) as alternatives to chroot for process isolation in containers, systemd, and tools like Docker/Podman, including security issues with user namespaces.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Systemd can put it in its own namespaces, like a container
why doesn't it just use user namespaces?
Don't user namespaces have significant security issues themselves?
It uses Linux kernel namespaces instead of chroot (containers are just fancy Liunx chroot)
from the documentation it sounds like it uses namespaces where available, just like containers. chroot otherwise.
Not if you use user namespaces (which you really should).
Yes, it is. Either a magic user-space chroot, a normal chroot or user namespaces.
why not? I would argue, that they use linux namespacing, cgroup etc.
What happened to just using chroot(), namespaces, and copy-on-write?
why don't you use podman, bubblewrap or just straight namespaces?