Why is it possible to nest pid_namespaces?

user_7732820 0
Viewed 70

I don't see the advantage of nesting pid_namespaces. man 7 pid_namespaces states:

PID namespaces isolate the process ID number space, meaning that processes in different PID namespaces can have the same PID. PID namespaces allow containers to provide functionality such as suspending/resuming the set of processes in the container and migrating the container to a new host while the processes inside the container maintain the same PIDs.

If I nest the pid_namespaces, parent spaces shouldn't be able to access child spaces ordinary if they are filled with the same pids like in their own space. Furthermore it is not connected to any sort of advantage in terms of forming "containers".

So, why — as man 7 pid_namespaces states — is it possible to nest pid_namespaces?

linux
1 Answers

"Containers" in this context refer to technologies such as Docker, which allow you to have a lightweight "machine within a machine" without it being a full-fledged VM.

A container has a filesystem and a set of PIDs in its own namespace. This way, multiple containers can be running with their own set of PIDs in a way that won't conflict with each other. This allows for isolation between containers.

user_16871190
Related