Namespaces: What a Process Can See
Ask the running quicknotes container for its process list and you get a tiny answer: python as PID 1, and whatever command you used to look. Yet the host is running hundreds of programs. Nothing was hidden by Docker's magic; a Linux feature called namespaces simply gave that process a different view of the world.
The rule
Namespaces decide what a process can see.
A namespace wraps one kind of system resource so that the processes inside it get their own private copy. Docker places each container in a fresh set of them:
| Namespace | What the container gets its own copy of |
|---|---|
| pid | process numbers, so its main process is PID 1 |
| net | network interfaces, IP address, ports and routes |
| mnt | the list of mounted filesystems, so / is the image |
| uts | the hostname |
| ipc | shared-memory and message queues |
| user | user and group ID mapping (optional in Docker) |
You can see two of them at a glance:
docker run --rm alpine hostname
docker run --rm alpine ps(The tiny alpine image is used here because it ships a ps command; slim Python images leave it out.)
The hostname is the short container ID, not your machine's name (uts). The process list contains only the container's own processes (pid).
Crucially, namespaces change visibility, not location. The host can still see everything: on the host, the quicknotes python process appears with an ordinary number such as 48213.
The shortcut
For any "why can't I see X from inside?" question, name the namespace that holds X. Processes → pid, ports and addresses → net, files and mounts → mnt, hostname → uts.
The question
Two containers from
quicknotes:1.0both listen on port 5000. Why is there no clash?
The trap is asking namespaces to do a job they do not do. They hide and separate; they do not limit how much CPU or memory a process burns. That is the next lesson's feature.
Drills
Answer fast — trust the rule.
Which namespace gives a container its own IP address and ports?
Inside a container, what PID does its main process usually have?
Which namespace lets a container have its own hostname?
Can namespaces stop a container from using all of the host's memory?
From the host, you run ps while quicknotes is running in a container. What do you see?
Remember
- Namespaces decide what a process can see: pid, net, mnt, uts, ipc and user.
- Shortcut: name the namespace that holds the thing you are asking about.
- Trap: namespaces isolate the view; they do not limit resource use.