Container — Namespace Introduction

Introduction to common container namespaces

What is Namespace

We all know that the operating system uses virtual memory technology to make each user process think that it has all the physical memory, which is the virtualization of the memory by the operating system.

Also, through the time-sharing scheduling system, each process can be scheduled and executed fairly, that is, each process can obtain the CPU, so that each process thinks that it has all the CPU time during the process activity, which is the virtualization of the CPU by the operating system.

However, the above two virtualization technologies only virtualize the “physical resources”. In fact, on a host, there are many “non-physical resources” in the operating system, such as user permission, network protocol stack resources, and file system mount path resources. Through the namespace feature of Linux, these non-physical global resources can be virtualized.

According to wiki, Namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of processes sees one set of resources while another set of processes sees a different set of resources.

The feature works by assigning the same namespace for a set of resources and processes, but those namespaces refer to distinct resources. Namespaces are a fundamental aspect of containers on Linux.

How Namespace Works

Namespace is the underlying concept of the Linux system. It is implemented at the kernel layer.

• Each container runs in the same container runtime process and shares the same host system kernel.
• Each container must have an isolated running space similar to a virtual machine, but the container technology implements a running environment for running specified services within a process, and can also protect the host kernel from the interference and influence of other processes, such as file system space, network space, process space, etc.