Containers unplugged: Linux namespaces - Michael Kerrisk

Linux namespaces are a resource isolation technique. Each namespace type wraps some global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of that resource, when in fact there are multiple instances of the resource, with each instance private to a particular group of process. Namespaces are key building blocks for a number of interesting technologies--most notably containers, but also a range of other interesting applications such as Flatpak and Firejail.
In this presentation we'll look at various Linux namespace types--including UTS, mount, network, and PID namespaces--in order to understand what resources they govern and what use cases they serve. Along the way, we should have time for a live demo or two, so as to make the "theory" more concrete.
Save the date for NDC TechTown 2020 (31st of August - 3rd of September)
Check out more of our talks at:
ndctechtown.com/
www.ndcconferences.com/

[@EvanCarrollTheGreat]

One of the very best talks on namespaces and Linux. Thanks a ton!

[@king0s]

. I need to consume this in multiple pieces. I love the depth. ❤ and 🙏 gratitude from Chennai.

[@hassanhashemi6478]

Great talk, Really enjoyed watching. Thanks Michael..

[@lexdarocy]

Thank you so much for this, I use what you taught me in this lecture everyday

[@janp.monsch3383]

Great introduction to namespace.

[@aravindhankrishnan1300]

Excellent, concise and precise. Thanks!

[@sahilgupta3564]

Really enjoyed this tutorial. :)

[@puneetmathur]

Wow! Very enlightening. Thank you!

[@hiccupmaster3572]

For those who want to see the next session kzbin.info/www/bejne/bWTRc2xjfb6Vd6s

[@90hijacked]

Thank you !!!

[@nacholupotti3644]

Masterclass! Excelent explanation, i am right now going to part 2. Thanks!

[@attilakun7850]

Excellent talk. Regarding the question at the very end: I think network namespaces provide isolation for Unix domain sockets too. If so, how can there be a Unix domain socket connection between two different network namespaces?

[@MichaelKerrisk]

Network namespaces provide isolation of so-called abstract UNIX domain sockets. But normal UNIX domain sockets are not isolated by network namespaces, and thus it's possible to establish a UNIX domain socket connection between network namespaces.

[@mujeexminiminer7653]

This talk just made me realize the gap in my linux knowledge, because I didn’t understand sh*t😅 Nevertheless, it was a great talk!!! Will surely revisit some time later

[@Trippykiyay]

Any idea where to get the slide deck for this presentation?

[@manishnaik2052]

Why did they write docker in go? All the C namespace apis are clear and concise already.

[@nasirmahmood7799]

where is the 2nd part . thanks.

[@DennisBuduev]

I guess it is here kzbin.info/www/bejne/bWTRc2xjfb6Vd6s

[@stackunderflow5951]

It might be better to demo not only the PID and UTS namespaces like mount namespace

[@cryp0g00n4]

What does the $$ do? @19:00

[@orustammanapov]

if I'm not mistaken it holds PID of the current process (in this case it should be shell PID it's being executed in)

[@nasirmahmood7799]

@@orustammanapov -- your shell's PROCESS ID -- echo $$ will show you what is actually is