Linux Namespaces and Control Groups
Linux namespaces give a process a restricted view of selected system resources. Control groups organize processes into a hierarchy that accounts for and controls their use of CPU, memory, I/O, and other resources.
itLinux | OpenSkills.info
Intro
Linux Namespaces and Control Groups
Linux namespaces and control groups, usually called cgroups, are kernel mechanisms for managing processes. A namespace changes what a process can see. A cgroup changes how much of a resource a process group can use and records what it has used. Container runtimes combine both mechanisms with capabilities, filesystem setup, and syscall filtering, but namespaces and cgroups are useful outside containers too.
These mechanisms do not create a second kernel. Namespaced processes still issue system calls to the host kernel. That shared-kernel boundary gives containers low overhead, but it also means a namespace boundary is not equivalent to a virtual-machine boundary.
Two independent dimensions
A process belongs to one namespace of each supported type. Each type isolates a particular view:
- A mount namespace supplies a mount table, so a process can see a different filesystem layout.
- A PID namespace supplies a process-ID view. The first process in a new PID namespace has PID 1 there and has special responsibilities for child processes.
- A network namespace supplies network devices, protocol stacks, routing tables, firewall rules, and port-number space.
- A user namespace maps user and group IDs between the namespace and its parent. A process can hold capabilities inside that namespace without holding the same capabilities in the initial user namespace.
- UTS, IPC, cgroup, and time namespaces isolate host and domain names, IPC objects, cgroup-root views, and selected clocks.
Cgroups answer a different question. The cgroup v2 hierarchy places processes in a tree. Controllers expose files that account for or control resources such as CPU, memory, I/O, and process count. A process can share every namespace with another process while belonging to a different cgroup, or share a cgroup while using different namespaces.
This separation is the central mental model: namespaces partition views; cgroups organize and govern resource use.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://man7.org/linux/man-pages/man7/namespaces.7.html
Supports
- Namespace types and the resources each isolates
- clone, unshare, setns, proc namespace handles, permissions, and lifetime
- User namespace creation exception and namespace-count limits
- https://man7.org/linux/man-pages/man2/clone.2.html
Supports
- Clone flags and kernel versions for namespace types
- Child namespace creation and capability requirements
- User namespace implementation milestones
- https://man7.org/linux/man-pages/man2/unshare.2.html
Supports
- Calling-process namespace creation
- Namespace-specific flag behavior and privilege checks
- https://man7.org/linux/man-pages/man2/setns.2.html
Supports
- Joining namespaces referenced by file descriptors
- User and cgroup namespace permission constraints
- https://man7.org/linux/man-pages/man7/user_namespaces.7.html
Supports
- UID and GID mappings and capability scope
- Namespace ownership and unprivileged creation since Linux 3.8
- Filesystem and parent-namespace constraints
- https://man7.org/linux/man-pages/man7/pid_namespaces.7.html
Supports
- Nested PID visibility and multiple process IDs
- PID 1 signal, child-reaping, and termination behavior
- https://man7.org/linux/man-pages/man7/network_namespaces.7.html
Supports
- Isolation of devices, stacks, routes, firewall rules, sockets, and ports
- Physical and virtual device behavior when a namespace is freed
- https://man7.org/linux/man-pages/man7/mount_namespaces.7.html
Supports
- Per-namespace mount lists and mount propagation
- https://man7.org/linux/man-pages/man2/mount.2.html
Supports
- Mount namespace availability from Linux 2.4.19
- https://man7.org/linux/man-pages/man7/cgroup_namespaces.7.html
Supports
- Virtualized cgroup path views and cgroup namespace roots
- Distinction between path view and actual cgroup membership
- https://man7.org/linux/man-pages/man7/time_namespaces.7.html
Supports
- Time namespace clock offsets and Linux 5.6 availability
- https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
Supports
- Unified hierarchy, core files, topology rules, and delegation
- CPU, memory, I/O, and PIDs controller semantics
- Cgroup namespace interaction, migration, events, freezing, and killing
- https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/index.html
Supports
- Legacy cgroup documentation and the historical multiple-hierarchy model
- https://www.kernel.org/doc/html/latest/accounting/psi.html
Supports
- CPU, memory, and I/O stall metrics
- some, full, rolling averages, total time, and triggers
- https://man7.org/linux/man-pages/man7/capabilities.7.html
Supports
- Capability units and CAP_SYS_ADMIN operations
- Capability evaluation with user namespaces
- https://systemd.io/CGROUP_DELEGATION/
Supports
- systemd ownership of the cgroup hierarchy
- Service placement, scope and slice roles, and delegated subtrees
- https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md
Supports
- OCI Linux namespace, UID mapping, capability, device, and cgroup resource fields
- https://www.kernel.org/pub/linux/kernel/v2.4/
Supports
- August 2002 release date for Linux 2.4.19
- https://kernelnewbies.org/Linux_2_6_24
Supports
- January 2008 release date
- Merge of task control groups, PID namespaces, and basic network namespaces
- https://lwn.net/Articles/680615/
Supports
- Namespace work beginning around 2002 and cgroup work beginning in 2006
- cgroup project origin and naming
- cgroup v2 becoming non-experimental in Linux 4.5
- https://github.com/sindresorhus/awesome
Supports
- Discovery route to the curated Containers awesome list
- https://github.com/Friz-zy/awesome-linux-containers
Supports
- Discovery of runc, LXC, Podman, NsJail, Kata Containers, and gVisor in the Linux container ecosystem
- https://github.com/opencontainers/runc
Supports
- runc as a Linux OCI runtime using bundles and the runtime specification
- Namespace and cgroup setup below higher-level container engines
- Apache-2.0 licensing
- https://linuxcontainers.org/lxc/introduction/
Supports
- LXC system containers and use of kernel namespaces and cgroups
- Low-level configuration and unprivileged-container model
- https://linuxcontainers.org/incus/docs/main/explanation/security/
Supports
- Default unprivileged containers and user namespace mapping
- Cgroup visibility and host-kernel security boundary
- https://docs.podman.io/en/latest/markdown/podman.1.html
Supports
- Rootless user namespace creation and subordinate ID requirements
- OCI runtime and cgroup manager integration
- https://nsjail.dev/
Supports
- Namespace, cgroup, rlimit, and seccomp composition for process isolation
- Apache-2.0 licensing
- https://gvisor.dev/docs/
Supports
- OCI runsc runtime and user-space application-kernel boundary
- https://kata-containers.github.io/kata-containers/quick-start-guide/
Supports
- Lightweight VM isolation compared with runc shared-kernel isolation
- OCI-compatible container and Kubernetes integration
- https://docs.docker.com/engine/containers/resource_constraints/
Supports
- Docker memory and CPU flags configuring host cgroup controls
- Default absence of container resource limits and OOM implications
- https://github.com/containers/crun
Supports
- crun as an OCI runtime with cgroup v2 and rootless support
- GPL-2.0 licensing
- https://systemd.io/CONTAINER_INTERFACE/
Supports
- systemd-nspawn container-manager integration with namespaces and cgroups
- Service-manager ownership of lifecycle and resource hierarchy