The error is caused by the PID 1 process exits in the new namespace. After bash start to run, bash will fork several new sub-processes to do somethings. If you run unshare without -f, bash will have the same pid as the current “unshare” process. The current “unshare” process call the unshare systemcall, create a … Read more
Text from https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/7-Beta/html/Resource_Management_and_Linux_Containers_Guide/sec-Linux_Containers_Compared_to_KVM_Virtualization.html Copyright © 2014 Red Hat, Inc.: Linux Containers Compared to KVM Virtualization The main difference between the KVM virtualization and Linux Containers is that virtual machines require a separate kernel instance to run on, while containers can be deployed from the host operating system. This significantly reduces the complexity of container creation … Read more
That’s because docker is not creating the reqired symlink: # (as root) pid=$(docker inspect -f ‘{{.State.Pid}}’ ${container_id}) mkdir -p /var/run/netns/ ln -sfT /proc/$pid/ns/net /var/run/netns/$container_id Then, the container’s netns namespace can be examined with ip netns ${container_id}, e.g.: # e.g. show stats about eth0 inside the container ip netns exec “${container_id}” ip -s link show eth0