diff --git a/container-101/.gitignore b/container-101/.gitignore new file mode 100644 index 0000000..3aaf40f --- /dev/null +++ b/container-101/.gitignore @@ -0,0 +1,4 @@ +###################### +.DS_Store +.DS_Store? +._* diff --git a/container-101/namespaces/index.json b/container-101/namespaces/index.json index 5137039..7eaab2a 100644 --- a/container-101/namespaces/index.json +++ b/container-101/namespaces/index.json @@ -11,6 +11,10 @@ { "title": "unshare", "text": "unshare.md" + }, + { + "title": "overview", + "text": "overview.md" } ] }, diff --git a/container-101/namespaces/overview.md b/container-101/namespaces/overview.md new file mode 100644 index 0000000..bdd6c1a --- /dev/null +++ b/container-101/namespaces/overview.md @@ -0,0 +1,28 @@ +"If host is a house, namespace is the room within the house assigned to each children providing privacy. Each child can only see inside their own room but not anything outside their room." -- KodeKloud (Youtuber) + +What is namespace? +Namespace are used by container to implement network isolation. + +Process ID(PID) namespace: +PID helps system tracks a specific task on the computer. +Ex. When you have safari and chrome searching on google for things, PID is used to identify where to direct the package sent back from google. +PID == 1 means it is the common ancestor to all the processes below. + +Net namespace: +Network namespaces allow processes inside each namespace instance to have access to a new IP address along with the full range of ports. +Ex. Allowing us to run multiple versions of an email server listening on port 25 without any software conflicts. + +UTS namespace: +Allows a single system to have different host and domain name to different processes. + +User namespace: +Allows system to restrict access to sensitive files. +Ex. Not letting people using the same computer to access files that should not be seen by them. + +Mount(mnt) namespace: +The mount namespace is used to isolate mount points such that processes in different namespaces cannot view each others' files.(just like chroot cmd) + + +RESOURCES: +1. https://www.youtube.com/watch?v=j_UUnlVC2Ss (Network Namespaces Basics Explained in 15 Minutes)(Youtube) +2. https://www.redhat.com/sysadmin/7-linux-namespaces (The 7 most used Linux namespaces)(Web) \ No newline at end of file diff --git a/container-101/namespaces/unshare.md b/container-101/namespaces/unshare.md index 8584ab3..ef22e97 100644 --- a/container-101/namespaces/unshare.md +++ b/container-101/namespaces/unshare.md @@ -1,7 +1,7 @@ input by normal user ``` -unshare --user --map-root-user --pid --mount --fork +unshare --user --map-root-user --pid --mount --fork ``` ``` @@ -35,4 +35,52 @@ lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 time -> 'time:[4026531834]' lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:51 time_for_children -> 'time:[4026531834]' lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 user -> 'user:[4026532478]' lrwxrwxrwx 1 shawn111 shawn111 0 Oct 3 17:50 uts -> 'uts:[4026532304]' -``` \ No newline at end of file +``` + + + +Unshare is used to create new namespace +``` +#sudo unshare -u +``` + +Shows your current hostname +``` +#hostname +ubuntu +``` + +Change your current hostname +``` +#hostname hello +#hostname +hello +``` + +But when you open a new tab, and check the host name +``` +#hostname +ubuntu +``` + +To see the namespace of the current terminal +``` +#ls /proc/$$/ns +cgroup ipc mnt net pid pid_for_children user uts +#readlink /proc/$$/ns/uts +uts:[4026532341] +``` + +But at the other terminal you opened +``` +#readlink /proc/$$/ns/uts +uts:[4026531838] +``` +The uts is different! +Meaning it is at different UTS namespace. +However, if we check the mount namespace, it is the same. +``` +#readlink /proc/$$/ns/mnt +mnt:[4026531840] +``` +This is because it is mounted on the same mount point. It is just separated under the point.