Namespaces and Capabilities

In this lesson, we explore how Docker leverages Linux namespaces and capabilities to isolate and secure containerized processes. You’ll learn about PID namespaces, user mappings, and fine-grained capability controls.

Process Isolation with PID Namespaces

Docker uses Linux namespaces to give each container its own view of system resources—PIDs, network interfaces, IPC, mounts, and time-sharing clocks:

When Linux boots, it creates a single init process (PID 1) and forks all other processes from it. On the host, PIDs must remain unique, but containers also need a PID 1 without colliding with host IDs. PID namespaces solve this by providing each container its own PID space.

Processes inside the container see only PIDs 1 and 2, while the host maps them to PIDs 5 and 6.

Demonstration

1. Launch a container that sleeps for an hour:

   docker run -d --name pid-namespace-test ubuntu sleep 3600
   

2. Inside the container, list processes:

   docker exec -it pid-namespace-test bash -c "ps aux"
   

   USER   PID %CPU %MEM    VSZ   RSS TTY STAT START   TIME COMMAND
   root     1  0.0  0.0   4528   828 ?    Ss   03:06   0:00 sleep 3600
   

3. On the host, verify the same process has a different PID:

   ps aux | grep sleep
   

   USER   PID %CPU %MEM    VSZ   RSS TTY STAT START   TIME COMMAND
   root  3816  0.0  0.0   4528   828 ?    Ss   06:06   0:00 sleep 3600
   

The output shows how PID namespaces isolate container processes from the host.

User and Process Ownership

By default, Docker runs container processes as root inside the container, which maps to root on the host. To confirm:

docker run --rm ubuntu sleep 1
docker ps

To run processes as a non-root user, use the --user flag:

docker run --rm --user 1000 ubuntu sleep 3600
docker exec -it <container_id> bash -c "ps aux"

USER   PID %CPU %MEM    VSZ   RSS TTY STAT START   TIME COMMAND
1000     1  0.0  0.0   4528   828 ?    Ss   03:06   0:00 sleep 3600

You can also set a default user in your Dockerfile:

FROM ubuntu
USER 1000

docker build -t my-ubuntu-image .
docker run --rm my-ubuntu-image sleep 3600
docker exec -it <container_id> bash -c "ps aux"

USER   PID %CPU %MEM    VSZ   RSS TTY STAT START   TIME COMMAND
1000     1  0.0  0.0   4528   828 ?    Ss   03:06   0:00 sleep 3600

Linux Capabilities

Beyond namespaces, Docker restricts container privileges by dropping most Linux capabilities from the root user inside a container. This prevents operations like rebooting the host or altering network configurations.

By default, containers run with a minimal set of capabilities. You can customize them using --cap-add, --cap-drop, or the --privileged flag:

That’s it for namespaces and capabilities in Docker. Proceed to the next lesson for more on container networking and storage.

Links and References

• Docker run reference
• Linux namespaces overview
• Docker security documentation