Skip to main content
In this lesson we explain how Docker uses Linux namespaces to isolate container workspaces from the host kernel. Understanding namespaces is essential to grasp how containers provide process, network, and filesystem isolation while still sharing the host kernel. Docker leverages several Linux namespace types to partition kernel resources for containers. Each namespace type creates a view of a resource that appears independent inside the container while the underlying kernel remains the same. Common namespace types include PID (process IDs), Network (interfaces/routing/firewall), IPC (shared memory/semaphores), Mount (filesystem mounts), UTS (hostname/domain), and User (user/group IDs).
A diagram titled "Linux Namespaces" showing six colorful cards labeled PID, Network, IPC, Mount, UTS, and User. Each card gives a brief description (e.g., PID — process IDs; Network — interfaces/routing/firewall; IPC — shared memory/semaphores; Mount — filesystem mounts; UTS — hostname/domain; User — user/group IDs).
Summary table of common namespace types Focus: PID namespaces When Linux boots it creates a single initial process (PID 1) from which other processes spawn. PID namespaces let processes in a child namespace have a separate PID numbering that starts at 1. This is why a container appears to have its own init/service process (PID 1) and its own independent process tree even though those processes are actually running on the host kernel. How PID namespaces behave in practice
  • Inside the container: an init/service process appears as PID 1 and all container processes are numbered relative to that namespace.
  • On the host: the same container processes exist as normal host processes and are assigned host PIDs from the host PID namespace.
  • A single process can therefore have different numeric PIDs depending on which PID namespace view you use.
PID numbers are unique within a given PID namespace. A process may appear as PID 1 inside its container namespace while having a different PID on the host.
A diagram illustrating PID namespaces: the Linux host shows processes with PIDs 1–6 on the left. On the right a child/container PID namespace contains its own processes labeled PID 1 and PID 2.
Example: running NGINX inside a container From inside the container you might list processes with a simple ps:
From the Docker host, the same running processes show host-assigned PIDs (and co-exist with other host processes):
This demonstrates two key points:
  • Container processes are real host processes managed by the kernel.
  • PID namespaces provide an isolated PID numbering and a container-local process tree (with PID 1 inside the container).
How to inspect PID namespaces and processes
  • View host processes: ps aux or ps -ef.
  • View processes inside a running container: docker exec -it <container> ps aux (or use docker top <container>).
  • See namespace details on the host: lsns -t pid shows existing PID namespaces.
  • Run an interactive shell in a new PID namespace for testing: sudo unshare --pid --fork --mount-proc bash (creates a new PID namespace where the new shell is PID 1).
Links and references If you want examples or commands tailored to your environment (e.g., how to inspect namespaces on a specific distro), tell me your OS and Docker version and I’ll provide step-by-step commands.

Watch Video