An exhaustive engineering guide exploring Linux namespaces, cgroups, boundary escape vulnerabilities, dangerous volume mappings, Docker socket exposures, and runtime confinement with Seccomp and AppArmor.
How the Linux kernel creates process isolation without hypervisor virtualization.
Containers are not virtual machines. A container is simply a standard Linux process running with restricted views of kernel resources enforced by namespaces and resource limits enforced by cgroups.
Namespaces isolate global system resources: PID (process IDs), NET (interfaces and routes), MNT (filesystem mounts), IPC (inter-process communication), UTS (hostname), USER (UID/GID mappings), and CGROUP (cgroup hierarchy).
| Namespace | Isolated Resource | Security Significance |
|---|---|---|
| pid | Process ID numbering | Container PID 1 cannot see or kill host processes |
| net | Network stacks & sockets | Isolates container listening ports from host interfaces |
| mnt | Mount tables & filesystems | Creates isolated root filesystem views |
| user | UID and GID mappings | Maps container root UID 0 to an unprivileged host UID |
Namespaces provide isolation, but they do not restrict access to hardware resources. That is the role of control groups (cgroups).
