Skip to main content
In this lesson, we explore how Docker leverages Linux namespaces and capabilities to isolate and secure containerized processes. You’ll learn about PID namespaces, user mappings, and fine-grained capability controls.

​
Process Isolation with PID Namespaces

Docker uses Linux namespaces to give each container its own view of system resources—PIDs, network interfaces, IPC, mounts, and time-sharing clocks:
The image is a diagram illustrating containerization, showing "Namespace" at the center connected to "Process ID," "Unix Timesharing," "Mount," "Network," and "InterProcess."
When Linux boots, it creates a single init process (PID 1) and forks all other processes from it. On the host, PIDs must remain unique, but containers also need a PID 1 without colliding with host IDs. PID namespaces solve this by providing each container its own PID space.
The image illustrates a PID namespace hierarchy in a Linux system, showing a parent system with PIDs 1 to 6 and a child system (container) with PIDs 1 and 2.
Processes inside the container see only PIDs 1 and 2, while the host maps them to PIDs 5 and 6.

​
Demonstration

  1. Launch a container that sleeps for an hour:
  2. Inside the container, list processes:
  3. On the host, verify the same process has a different PID:
The output shows how PID namespaces isolate container processes from the host.

​
User and Process Ownership

By default, Docker runs container processes as root inside the container, which maps to root on the host. To confirm:
To run processes as a non-root user, use the --user flag:
You can also set a default user in your Dockerfile:

​
Linux Capabilities

Beyond namespaces, Docker restricts container privileges by dropping most Linux capabilities from the root user inside a container. This prevents operations like rebooting the host or altering network configurations.
The image illustrates various Linux capabilities, such as CHOWN, KILL, and SETUID, represented in colorful blocks beneath a user icon. It also references the file path /usr/include/linux/capability.h.
By default, containers run with a minimal set of capabilities. You can customize them using --cap-add, --cap-drop, or the --privileged flag:
Granting --privileged mode gives the container all host capabilities, which can compromise security. Use it only when absolutely necessary.
For a full list of Linux capabilities, see Kernel Capabilities.
That’s it for namespaces and capabilities in Docker. Proceed to the next lesson for more on container networking and storage.

Watch Video