Compose a small container
Combine mount, UTS, and PID namespaces and mount a process view for the new namespace.
Jump to code and terminal ↓Primitives compose
Each namespace isolates one kind of state. UTS isolates a hostname. A mount namespace isolates the mount table. A PID namespace changes process identifiers. A small container runtime combines them, then launches a process in the resulting environment.
PID namespaces need a child
unshare does not move the caller into a new PID namespace. It creates one for future children. Use a fork so the child becomes PID 1. That process is responsible for reaping adopted children and has special signal behavior.
Give procfs the same view
A previously mounted /proc still describes the namespace that mounted it. In the private mount namespace, make mount propagation private and mount procfs again. The parent must retain its own /proc. This lesson composes namespaces; the later image runner adds the root filesystem and security policy.
Your goal
Create mount, UTS, and PID namespaces; fork into the PID namespace; mount private procfs; and run the child as PID 1.
What the tests observe
- Child is PID 1
- Three namespace identifiers differ
- Private procfs shows the child
- Parent state is unchanged
Need a nudge?
Hint 1
BusyBox unshare uses -m for mount, -u for UTS, -p for PID, and -f to fork.
Hint 2
Inside the child, mount --make-rprivate / prevents later mount events from propagating to the parent.
Hint 3
Mount a new process filesystem with mount -t proc proc /proc after entering the namespaces. Then set the hostname.
What happens inside Linux
The child now has three private kernel views, and procfs reflects the new PID namespace. This is an educational runtime core, not a secure container runtime: it still has root capabilities, the parent filesystem, shared networking, and no resource policy.
Optional account sync. Exercises work without an account.